10/23/2026
If your website runs on PHP, and most of the web does, including nearly every WordPress site, check its version this week.
Two critical vulnerabilities were disclosed in PHP itself (CVE-2026-109618 and CVE-2026-109619, severity 9.2 out of 10). They're the worst kind: unauthenticated remote code ex*****on, meaning an attacker needs no password and no account to run code on your server. Exploit details leaked before the announcement, and attacks are already being reported.
This isn't a plugin problem you can update away inside WordPress. The flaw is in the language underneath, so the only complete fix is a patched version of PHP. Here's the check we ran across the sites we manage this week:
Find your exact version. In WordPress: Tools → Site Health → Info → Server. You need the full number - "8.3" alone proves nothing.
Compare it to the patched floors for your branch: 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and above. Below your branch's floor means you’re exposed.
On PHP 8.1 or older? No patched release is coming. Those branches are out of security support. The fix is a branch upgrade, and this is the week to schedule it.
If your host manages PHP, confirm they applied the patch, don't assume it. If you upgrade yourself, restart PHP/Apache afterward (the old code keeps running until you do), then test your homepage, your admin login, and one form.
Back up before a branch upgrade. Routine patches are safe; jumping branches can break older plugins and themes.