PHP has announced an urgent security release for two critical vulnerabilities. Because WordPress and WooCommerce run on PHP, website owners should check whether their hosting provider is ready to apply the fixes. The full list of affected versions has not yet been confirmed.
Last reviewed: 21 October 2026 (AEST). Status: Security update announced; Australian Cyber Security Centre alert issued; official fixed versions pending. This is an ongoing security advisory and will be updated as PHP publishes further details.
Latest PHP vulnerability update
- Confirmed: The PHP security team has announced two critical vulnerabilities, each rated 9.2 under CVSS v4.0.
- Release timing: Fixes are scheduled for 21 October 2026 at 14:00 UTC, which is 12:00 am on Thursday 22 October in Queensland (AEST) and 1:00 am AEDT in NSW and Victoria. PHP says it may release earlier if details become public or attacks are seen.
- Australian alert: The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has issued an alert. It understands that all PHP versions from PHP 5 onwards may be affected and is not currently aware of active exploitation.
- Reported: Media reports identify the issues as CVE-2026-109618 and CVE-2026-109619 and describe a possible remote-code-execution risk. No official technical details have been released yet.
- Not yet confirmed by PHP: The exact affected versions, exploitation requirements, fixed version numbers and whether every publicly accessible PHP website is exposed.
The official notice is on PHP.net. CERT-EU and ASD’s ACSC are also advising organisations to prepare to patch. We will update the version information here after PHP publishes its release notes.
What are CVE-2026-109618 and CVE-2026-109619?
These are the identifiers being used in public reports about the two critical PHP security flaws. Researchers have described the potential for remote code execution, meaning an attacker could potentially run code on an affected server.
At the time of this update, PHP has confirmed the severity of two vulnerabilities but has not yet published the technical conditions required to exploit them.
The important distinction is that these are PHP vulnerabilities, not WordPress plugin or theme vulnerabilities. Updating WordPress is good security practice, but a WordPress core update alone does not install a patched PHP runtime on your server.
Does this affect WordPress websites?
Potentially. WordPress relies on PHP to run its server-side code, so a flaw in PHP can affect WordPress hosting independently of the WordPress version or installed plugins.
ASD’s ACSC understands that all PHP versions from PHP 5 onwards may be affected, so it is safest to assume your site is in scope until your host confirms otherwise. The official PHP advisory will identify exactly which versions and configurations need fixes.
That means the right first step is to check your site’s PHP version and speak to your hosting provider, rather than assuming a WordPress plugin update has resolved the problem.
How to check your PHP version in WordPress
You can find the PHP version reported by WordPress in your dashboard:
- Log in to your WordPress dashboard.
- Go to Tools → Site Health.
- Select Info and expand Server.
- Find the PHP version entry and ask your host whether that installation includes the upcoming security fix.
This shows the version WordPress is using, but it does not always tell the full security story. Some hosting providers install security patches through operating-system packages without changing the upstream version number shown in WordPress. Your host should be able to confirm the patched package or build.
Which PHP versions need updating?
PHP has not yet released the official affected version list. ASD’s ACSC understands that all versions from PHP 5 onwards may be affected, so older versions should not be assumed safe.
PHP currently maintains the 8.2, 8.3, 8.4 and 8.5 branches. Supported versions can receive security fixes, but you still need the specific patched update once it is available.
Versions 8.1 and earlier are end-of-life upstream and should be migrated to a supported version, unless your infrastructure vendor provides and confirms its own security backports.
For a longer-term upgrade, we recommend planning for PHP 8.3 or newer, subject to compatibility testing.
PHP 8.2 reaches the end of upstream security support on 31 December 2026. See the official PHP supported versions schedule.
What WordPress website owners should do now
1Confirm your hosting provider’s PHP patch plan
Ask when the new PHP security updates will be installed and how your host will confirm which versions or packages were patched.
If you manage your own server, monitor the official PHP release and your operating-system vendor’s security notices.
2Plan to replace unsupported PHP versions
PHP 7.4, 8.0 and 8.1 are no longer supported by the upstream PHP project.
If your website still uses one of these versions, schedule a move to a supported release. Test the upgrade on a staging website first, especially if you rely on older plugins or custom code.
3Back up your site and check compatibility
Take a recent off-server backup of the files and database.
Keep WordPress core, themes and plugins updated, then test important functions such as forms, checkout, search, login and integrations after changing PHP versions.
These updates improve compatibility and general security; they do not replace the PHP patch.
4Apply provider-recommended temporary protections
Until the official technical details are available, there is no single verified WordPress setting that can be described as a fix.
Follow mitigation guidance from PHP, your host and trusted security vendors if they publish it. Continue monitoring website and server logs, particularly if you have an internet-facing PHP application.
Will Wordfence or another security plugin protect my site?
WordPress security plugins can be useful as an extra layer of defence, and a firewall may block certain attack requests if the relevant patterns are understood.
But a plugin cannot repair a vulnerability inside the PHP runtime itself.
You should not rely on Wordfence, a WAF or another security plugin instead of installing the official PHP security update.
Frequently asked questions
Do I need to update WordPress as well as PHP?
Keep WordPress, plugins and themes updated, but remember that these reported flaws are in PHP. Your hosting provider or server administrator must install the applicable PHP security update.
Is PHP 8.1 or PHP 7.4 affected?
PHP has not yet confirmed the precise affected versions, but ASD’s ACSC understands that all versions from PHP 5 onwards may be affected. Both branches are out of upstream support, however, so upgrading should already be a priority. Ask your host about any vendor-specific security support in the meantime.
Can I update PHP from the WordPress dashboard?
Generally, no. PHP is controlled through your hosting account or server configuration, not through WordPress’s plugin or core updater. If you are unsure, ask your web hosting provider to manage the change.
Are websites already being attacked?
Public reports describe leaked vulnerability information, but that does not establish widespread exploitation. As of this update, ASD’s ACSC says it is not aware of active exploitation.
Check current vendor advisories rather than relying on assumptions.
Security advisory update history
- 21 October 2026: Initial advisory prepared. Two critical PHP vulnerabilities confirmed; the official affected and fixed version lists remain pending.
- 21 October 2026 (afternoon): Added ASD’s ACSC alert. All PHP versions from PHP 5 onwards may be affected; no known active exploitation.
- Next update: Add confirmed CVE identifiers, fixed PHP releases, affected configurations and mitigation guidance after PHP publishes its security release.
Sources: PHP’s critical security release notice; PHP supported versions; CERT-EU advisory 2026-018; ASD’s ACSC Alert Service notice, 21 October 2026.
Need help updating PHP or securing WordPress?
Thrive Digital provides WordPress hosting, website maintenance and technical support.
If your site is running an outdated PHP version or you need help planning a safe upgrade, contact our team.
You can also read our earlier guide to WordPress core security updates.
