WordPress owners have a hosting question to ask today: has the PHP runtime serving their website received the emergency security fixes released on 21 October?
The PHP security team says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address two critical vulnerabilities that can permit remote code execution without authentication. The issues are tracked as CVE-2026-109618 and CVE-2026-109619 and are widely discussed as PHP2Shell.
Why it matters for a business website
Wiz Research’s original findings locate the flaws in PHP itself. Its researchers demonstrated unauthenticated code execution against WordPress, Drupal and Joomla deployments. They also demonstrated disclosure of sensitive process memory. Updating a plugin or checking that WordPress core is current does not establish that the underlying PHP installation is patched.
PHP’s advisory includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the installations at risk. It identifies mod_php as the highest-risk configuration, with a demonstrated attack that can trigger before application code runs. That distinction helps administrators prioritise; it does not make other PHP deployments safe to ignore.
Ask for evidence of the hosting update
For a managed website, our practical recommendation is to send the hosting provider a short request:
Please confirm that the PHP runtime serving our website has fixes for CVE-2026-109618 and CVE-2026-109619. Which PHP or vendor package version is now running, and has the update been applied to every relevant web worker?
Record the answer against the website and hosting account. If several people manage your infrastructure, assign one person to close the check. A general assurance that automatic updates are enabled is less useful than confirmation of the package actually deployed.
The PHP team notes that distribution and long-term-support vendors may supply backported fixes. Where that applies, ask for the vendor’s advisory and package reference rather than judging patch status only from a familiar upstream version number. PHP’s position is that an update is the complete solution; temporary mitigations address only particular attack paths.
Balance urgency with a focused site check
After the provider confirms the update, we recommend checking the customer journeys that matter to your business: opening key pages, submitting a contact form and, where relevant, completing a controlled checkout test. Keep a record of any errors and who owns the follow-up.
Compatibility testing takes time, but an open-ended testing window is a poor response to an urgent runtime advisory. Agree a short validation plan with your host and developer, including how they will handle a failed check without leaving the vulnerable runtime as the long-term fallback.
Our view
The useful outcome is a documented answer to who patches PHP, what they deployed and whether the site still works. Make that part of your maintenance record. This incident is a reason to check the hosting layer directly, even when the WordPress dashboard looks up to date.
Sources checked on 22 October 2026. The operational checklist above is Nevelit’s editorial recommendation; the vulnerability details and fixed versions come from the linked primary sources.
Leave a Reply