PHP emergency fixes: updating WordPress alone may leave the runtime exposed

On October 21, the PHP project released emergency fixes for two vulnerabilities that can allow code execution without a login.

Exposure depends on configuration and execution paths; this does not mean every PHP website has been breached.

The problem sits beneath the application

Services such as WordPress run on the PHP runtime. PHP2Shell concerns memory management and error handling in that underlying software. When processing fails, PHP can mishandle unfinished data or memory that has already been released. Updating a theme, plugin or WordPress installation therefore does not necessarily update PHP itself.

Which releases contain the fixes?

The first fixed versions in the supported branches are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The identifiers are CVE-2026-109618 and CVE-2026-109619. Distributors may backport fixes while retaining an older version number. Ask the hosting provider for the security advisory covering both identifiers and the PHP runtime actually serving web requests.

A firewall provides an additional layer

Cloudflare says it observed attack attempts in its customer traffic and deployed mitigations. Observing hostile traffic does not establish that every attempt succeeded. Cloudflare also participated in coordinated disclosure, so it is not wholly unrelated to the research. Its own observations provide a separate check, while its firewall does not replace the PHP patch.

What administrators should verify next

Administrators should check compatibility, take backups, install the fixed packages and restart the relevant web server, PHP-FPM and long-running workers. Command-line PHP can differ from the web runtime. Ordinary visitors cannot establish patch status by opening a page. Follow PHP’s official advisory and the host’s package changelog; this briefing does not determine whether any particular site has been compromised.

Primary sources and independent checks

Primary: PHP Foundation announcement covering fixed releases, conditional exposure, both CVEs and disclosure: PHP Foundation · 2026-10-21

Separate check: observations in its own customer traffic and mitigation; a disclosure participant, not an unrelated institution: Cloudflare · 2026-10-21

Research advisory: first fixed releases and runtime updates/restarts; exploit instructions are not reproduced: PHP2Shell · research advisory

Read in other languages

한국어 · English · Español · 日本語 · Tiếng Việt