22 October 2026
Critical PHP security update: a WordPress checklist
On 21 October 2026, the PHP project released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. Because WordPress runs on PHP, site owners should check whether their hosting environment has received the relevant fix. That does not mean every WordPress site has been compromised—but it is a reason to act promptly. PHP security advisory
What happened?
The PHP project published fixes for CVE-2026-109618 and CVE-2026-109619 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. These issues affect PHP itself, including installations that serve web requests for WordPress and other PHP applications. Hosting providers and Linux vendors may also distribute patched packages or backports, so a version number alone may not tell the full story. Ask your host to confirm patch status for your particular environment. PHP security advisory
PHP 8.1 and earlier no longer receive security releases from the PHP project. Some vendors may provide their own backported fixes, but if your site is on an older branch, you should discuss both the immediate patch and a move to a supported version with your host. PHP security advisory
Is this a WordPress update?
No. WordPress has confirmed that these vulnerabilities are not specific to WordPress and that no WordPress core update is required or planned for them. Updating WordPress, a theme or a plugin is not a substitute for updating the PHP runtime or receiving the appropriate vendor patch. WordPress security notice
What should you check now?
- Find the PHP version your site uses. In WordPress, go to Tools → Site Health → Info → Server. Your hosting control panel may show it too.
- Ask your host whether the fix is applied. Give them the two CVE numbers above and ask whether your server has an updated PHP package or an appropriate vendor backport. Ask when the update will be applied if it has not happened yet.
- Plan the change safely. Confirm who controls the PHP update, ensure there is a usable backup and rollback route, and identify any plugins or custom code that may need compatibility testing.
- Test the site after the update. Check the homepage, important content pages, admin login, contact forms and—if relevant—checkout and other revenue-critical journeys. Record anything that needs follow-up.
If you cannot update promptly, ask your hosting provider or security adviser about the immediate risk and suitable interim steps. The PHP project says interim mitigations are not a complete solution; updating remains the safe course. PHP security advisory
What if you think the site has already been compromised?
A routine PHP update does not determine whether an intrusion has occurred or clean a compromised site. If you see unexplained users, changed files, redirects or other suspicious activity, treat that as a separate incident. Contact your host and a qualified incident-response specialist; preserve relevant evidence and agree containment steps before making broad changes.
How We Are Remote can help
Our PHP Security Check + Update Support offer is designed to turn uncertainty into a clear plan. We can review the site’s PHP details and host’s patch confirmation, agree a backup and rollback route, coordinate a supported update where access permits, then test the key website journeys and provide a short handover.
We agree the scope, price and timing before touching production. Hosting-provider work, malware removal, forensic investigation and major compatibility repairs are outside the standard check and may need a separate quote or specialist support. We cannot promise that a site has never been compromised or that every hosting platform can be patched directly by us.
Need help checking your WordPress site? Contact We Are Remote with your site URL and hosting provider, if known. Please do not send passwords through the contact form.