Two recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have raised concern because they could allow an unauthenticated attacker to run code on a vulnerable server under certain conditions. They affect PHP itself, which powers many websites and applications, including WordPress.
The practical takeaway for website owners is straightforward: ask your hosting provider or site administrator which PHP version your site uses, and confirm that it has been updated or otherwise secured.
What are the vulnerabilities?
Both flaws involve PHP’s handling of memory while processing web requests.
- CVE-2026-109618 involves an out-of-memory error during request processing. PHP may leave internal request data in an incomplete state, which can lead to memory corruption during cleanup.
- CVE-2026-109619 involves stale references to memory that has already been released. Later processing may use that outdated state.
Under certain conditions, an attacker could exploit these flaws to achieve remote code execution. That means the attacker may be able to run commands on the server. The PHP project has issued fixes, and security agencies recommend applying the relevant updates promptly.
Does this mean WordPress itself is vulnerable?
These CVEs affect the PHP runtime, rather than a particular WordPress plugin or theme. A WordPress site can still be exposed if its server runs an affected PHP version, even if WordPress and its plugins are up to date.
The exact risk depends on the PHP version, server configuration, and how the hosting environment handles requests. Red Hat notes that exploitation requires precise conditions and may be more difficult in common PHP-FPM setups than with some other configurations. That does not remove the need to update.
What should WordPress site owners do?
1. Check which PHP version your site uses
Look in your hosting control panel or ask your hosting provider. Many website owners do not manage PHP directly, especially on shared hosting, so the provider may need to confirm the version and apply the update.
2. Update to a fixed version
The fixed PHP releases listed in NVD are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Hosting providers may backport fixes into their own PHP packages, so check your provider’s advisory rather than relying on the version number alone. If your site runs an older, unsupported PHP branch, ask about moving it to a supported version.
3. Check software that bundles PHP
PHP may also be included in containers, appliances, or other hosting products. Updating WordPress alone will not update PHP in those environments. Review the vendor’s security notice and apply its specific update.
4. Use temporary mitigations only with provider guidance
Configuration changes may reduce exposure, but they can affect uploads or other site functions and are not a substitute for a complete security patch. Red Hat specifically cautions that mitigations can disrupt workloads and that patching is the comprehensive fix. Site owners on managed or shared hosting should ask the provider to handle server-level changes.
5. Review the site if it was exposed
If your server was running affected PHP and publicly accepting requests before it was patched, ask your hosting provider or security professional whether logs and files should be checked for signs of compromise. Keep a current backup and make sure you know how to restore it.
What should business owners ask their host?
You can send your hosting provider this short request:
Is my website’s PHP runtime affected by CVE-2026-109618 or CVE-2026-109619? Has the applicable security fix been installed, including any provider backports? If not, when will it be applied?
Keep the reply with your site maintenance records. If the host cannot confirm the status, ask them to escalate the question to their server or security team.
Keep WordPress and PHP maintenance connected
WordPress security depends on more than plugins and passwords. The server software that runs the site matters too. Keep WordPress, themes, and plugins maintained, but also confirm that PHP and the hosting environment receive security updates.
For a business website, the best next step is to verify the PHP status with the hosting provider and follow its instructions for the specific environment. Otto Web Solutions supports WordPress and WooCommerce sites with ongoing maintenance and practical security guidance.
This article is general information, not a substitute for your hosting provider’s or software vendor’s security instructions.
