PHP critical security release, October 2026: what it means for your WordPress site (live updates)

Live updates. Last updated: 23 October 2026, 12:07 UTC.

php.net released a critical PHP security release on 21 October 2026, ahead of the planned 14:00 UTC. It fixes two vulnerabilities, both rated CVSS v4.0 9.2. Every WordPress site runs on PHP, so treat your sites as potentially affected until they're on a fixed version.

Security researchers are calling the vulnerabilities "PHP2Shell".

Here's the short version:

• php.net released the fix on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• A fix is available for every PHP version from 7.4 to 8.5. For 8.1 and older it comes as source patches rather than a new release, so upgrading to PHP 8.2 or newer is still the best long-term step.
• We've patched every PHP version on the Wordify platform, from 7.4 to 8.5. You don't need to do anything for your sites to get the fix. See the status page for details.
• On 23 October, PHP published an advisory about a related, lower-risk issue, CVE-2026-115560. The mitigation PHP recommends was already in place on the Wordify platform, so you don't need to do anything.
• If your site is on PHP 7.4, 8.0, or 8.1, move it to PHP 8.2 or newer now.

We'll keep this post updated as things happen. See Live updates for the latest, newest first.

How to check your site is patched

You can see the PHP version your site runs from inside WordPress:

1. In wp-admin, go to Tools → Site Health and open the Info tab.
2. Expand Server and find PHP version.
3. Compare it with the table below.

On Wordify, every PHP version from 7.4 to 8.5 is patched. You don't need to do anything.

What we know

On 20 October 2026, the PHP security team gave advance notice of an upcoming security release. Here's what they've said:

• When: Released on 21 October 2026, ahead of the planned 14:00 UTC.
• What: Two critical vulnerabilities, both rated CVSS v4.0 9.2.
• Details: Full details and affected versions were published with the release, in php.net's security advisory.
• CVE IDs: CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), which security researchers have nicknamed "PHP2Shell".
• Timing: php.net said it could release earlier if details became public or there was evidence of active exploitation. It released ahead of the planned time.
• Related advisory: On 23 October, PHP published an informational advisory about a related, lower-risk issue, CVE-2026-115560. PHP describes it as an unlikely attack vector that it will fix in its next regular release, and no exploitation has been reported.

A fix is available for every PHP version from 7.4 to 8.5:

• PHP 8.5: 8.5.12 or later
• PHP 8.4: 8.4.27 or later
• PHP 8.3: 8.3.36 or later
• PHP 8.2: 8.2.35 or later
• PHP 8.1, 8.0, and 7.4: patched via source backports from the PHP security team (no new official release)

What the vulnerabilities are: php.net rates both as critical remote code execution flaws:

• CVE-2026-109618, RCE via out-of-memory corruption (GHSA-w8hw-w9fx-j79w): when PHP runs out of memory while handling a request, it can be interrupted part-way through setting up internal data, and then treat that half-built data as valid during cleanup.
• CVE-2026-109619, RCE via stale state between requests (GHSA-6wmf-4rv5-p3rp): internal data from one request can outlive the memory behind it, and a later request handled by the same PHP worker can pick up that stale data before it's reset.

Who is at risk: php.net says all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. It rates the risk highest for mod_php, where an attack can run before any application code.

php.net's advisory and the linked GitHub advisories have the full technical details.

What it means for your WordPress site

WordPress is written in PHP, so every WordPress site depends on the PHP version underneath it. php.net says all PHP installations serving web requests are at risk, so assume any WordPress site is in scope until it's on a fixed version.

The version your site runs matters most. According to php.net's supported versions page, only PHP 8.2, 8.3, 8.4, and 8.5 are still supported. PHP 8.1, 8.0, and 7.4 have reached end of life:

For PHP 8.1, 8.0, and 7.4, a patch is still available. Because these versions are end of life, the PHP security team has published it as a source patch rather than a new release. Those versions won't get future fixes, so upgrading to PHP 8.2 or newer is still the best step.

What Wordify is doing

• We've applied pre-emptive protections across the platform, including our web application firewall (WAF), ahead of the official fix.
• We've applied the fixes to every PHP version on the platform, from 7.4 to 8.5, during an emergency maintenance window. Sites on PHP 8.2 to 8.5 run the fixed releases, and sites on PHP 7.4, 8.0, and 8.1 have the PHP security team's source patches applied.
• On 23 October, PHP published an advisory about a related, lower-risk issue, CVE-2026-115560. The mitigation PHP recommends was already in place across the platform, and we'll apply PHP's fix when it's released.
• We'll keep this post updated if anything changes. Check our status page for platform status.

What you should do

1. Check your site's PHP version. In the Wordify dashboard, open the site, then under Hosting select PHP. You'll see the version the site is running.

2. If it's on PHP 7.4, 8.0, or 8.1, upgrade to PHP 8.2 or newer now. On Wordify, these versions have the PHP security team's source patches, but they won't get future fixes. Moving now puts your site on a version that's still supported.

On Wordify, PHP version changes use PHP Safe Updates. We check the site first, make the switch, clear the caches, and keep watching. If the new version breaks the site, we put the previous version back automatically and email you what happened. For most sites, that email includes the error WordPress reported, which usually points to the plugin or theme to update. To change version:

1. Open the site, then under Hosting select PHP.
2. Choose the new version and click Save.
3. Confirm in the dialog. Safe Update is on by default.

A tip on which version to pick: PHP 8.2 is supported until 31 December 2026, so if your plugins and themes support it, PHP 8.3 or newer gives you longer before your next upgrade.

Need a hand? Our support team is here 24/7.

Common questions

I'm on PHP 7.4, 8.0 or 8.1. Will I get the fix?

Yes, a patch is available. Because PHP 8.1 and older are end of life, the PHP security team has published it as a source patch rather than a new release. Those versions won't get future fixes, so upgrading to PHP 8.2 or newer is still the best step.

Will there be downtime?

The patch is already applied. We rolled it out across the platform on 21 October during an emergency maintenance window. Our status page has the full timeline.

Can you just upgrade my site to the latest PHP?

Not automatically. Some sites run plugins or themes that don't support PHP 8.2 or later yet, so a forced upgrade could break them. When you change version yourself, PHP Safe Updates checks the site as it switches. If your site isn't compatible, we put the previous version back and email you what happened. For most sites, that includes the error WordPress reported, which usually points to the plugin or theme to update.

Live updates

All times are UTC. Newest first.

23 Oct 12:07 UTC: PHP has published an informational advisory about a related, lower-risk issue, CVE-2026-115560. PHP describes it as an unlikely attack vector that it will fix in its next regular release, and no exploitation has been reported. The mitigation PHP recommends was already in place across the Wordify platform as part of our response on 21 October, so sites hosted on Wordify are protected and you don't need to do anything. We'll apply PHP's fix when it's released.

21 Oct 22:56 UTC: Added how to check whether your site is patched.

21 Oct 16:36 UTC: The Wordify platform is patched

We've applied the fixes for CVE-2026-109618 and CVE-2026-109619 to every PHP version we run, from 7.4 to 8.5. Sites on PHP 8.2, 8.3, 8.4, and 8.5 are running the fixed releases (8.2.35, 8.3.36, 8.4.27, and 8.5.12). Sites on PHP 7.4, 8.0, and 8.1 have the PHP security team's source patches applied. You don't need to do anything for your sites to get the fix.

PHP 7.4, 8.0, and 8.1 are still end of life and won't get future fixes, so moving to PHP 8.2 or newer is still the best long-term step. PHP Safe Updates checks your site as it switches and puts the previous version back if anything breaks.

21 Oct 13:45 UTC: php.net has released the fix

php.net has published its security advisory, ahead of the planned 14:00 UTC time. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix both vulnerabilities, which php.net confirms can allow unauthenticated remote code execution. The CVE IDs are confirmed as CVE-2026-109618 and CVE-2026-109619.

A fix is available for every PHP version from 7.4 to 8.5:

• PHP 8.5: 8.5.12 or later
• PHP 8.4: 8.4.27 or later
• PHP 8.3: 8.3.36 or later
• PHP 8.2: 8.2.35 or later
• PHP 8.1, 8.0, and 7.4: patched via source backports from the PHP security team (no new official release)

php.net says all PHP installations serving web requests are at risk. For PHP 8.1, 8.0, and 7.4, which are end of life, the PHP security team has published source patches given the severity.

We'll begin applying the patched builds across the platform shortly, during our emergency maintenance window. Follow our status page for progress.

21 Oct 13:00 UTC: We've seen attempts to exploit this on our platform, and blocked them

From 08:44 UTC this morning, attackers started sending requests to WordPress sites we host, using a public proof-of-concept exploit that researchers have linked to these vulnerabilities. We found a small number of these requests.

Our web application firewall's existing rules blocked every attempt we've found, and the extra protections we added at 10:35 UTC target this exploit specifically. We've found no sign that any got through.

Since about 12:00 UTC, we've also seen automated scanners checking large numbers of sites for ones that might be vulnerable. Our firewall is blocking those too. You don't need to do anything extra. We'll still apply php.net's patched builds as soon as they're released, and moving off PHP 8.1 or older is still the best step you can take.

21 Oct 11:55 UTC: A PHP core developer has said publicly that the only mitigation for these vulnerabilities is patching or upgrading PHP. That matches our plan: the protections we added this morning are an extra layer while we wait, and we'll apply php.net's patched builds as soon as they're released. If your site is on PHP 8.1 or older, upgrading to 8.2 or newer now is still the best step you can take.

21 Oct 10:35 UTC: We've applied pre-emptive protections across the Wordify platform, including our web application firewall (WAF), to help guard against these vulnerabilities ahead of the official fix. We'll still apply php.net's patched builds as soon as they're released.

21 Oct 05:40 UTC: Industry reports are citing CVE-2026-109618 and CVE-2026-109619 for these vulnerabilities. php.net hasn't confirmed them yet, and the CVE records aren't public. We'll update this post when the advisory is out.

21 Oct 03:00 UTC: php.net has announced the release; details due 14:00 UTC.