PHP Releases Fixes for Two Critical Remote Code Execution Flaws

The PHP security team has released fixes for two critical remote code execution vulnerabilities and urged users to update immediately. The security fixes are available in PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12. WordPress relies on PHP, so affected sites need a PHP update from their hosting provider or server administrator.

PHP runs application code on web servers, including the code behind WordPress. The flaws can let unauthenticated attackers execute code with the web worker's permissions. Updating WordPress alone cannot install the PHP fixes.

Before the release, hosting-software provider CloudLinux said attempts matching a circulating exploit pattern were being observed, in its 09:26 UTC status update. It did not identify who observed those attempts or confirm that any servers had been compromised.

Cloudflare's chief technology officer, Dane Knecht, also said attacks were emerging and described its firewall updates as a stopgap, Reuters reported before the release. The same report said the Australian Cyber Security Centre was not aware of active exploitation.

Separately, WordPress security company Patchstack says multiple hosting partners have reported active exploitation. Its notice does not name those providers or identify compromised sites. The reports do not establish how many sites, if any, have been compromised.

What Has PHP Confirmed About the Vulnerabilities?

PHP's published advisories identify two vulnerabilities, each rated 9.2 out of 10 under the CVSS v4.0 severity system. Both concern internal state that PHP handles incorrectly when processing requests.

CVE-2026-109618 involves corruption during PHP's internal handling of out-of-memory errors. A memory allocation failure can interrupt PHP before internal request data is fully initialised, leaving cleanup code to process invalid data. PHP confirmed unauthenticated remote code execution against Apache's mod_php with normal input and memory limits, before application code runs.

CVE-2026-109619 involves stale global state carried between PHP requests. A worker can retain a reference to memory belonging to a finished request, then access it while handling another request.

Exploitation requires suitable operations across requests handled by the same worker. The advisory documents confirmed paths involving session upload progress and, in PHP 8.5, fatal-error backtraces.

The warning followed a now-deleted Hacker News post claiming that two PHP flaws were due to be revealed on 22 October. watchTowr subsequently told BleepingComputer that the vulnerabilities were real and that it believed it had reproduced one of them.

Affected and Fixed PHP Versions

Both PHP advisories list the following fixed releases. The affected ranges below refer to each named branch; a distribution may supply a backported fix under its own package version.

PHP Branch	Affected Releases	Fixed Release
8.2	Before 8.2.35	8.2.35
8.3	Before 8.3.36	8.3.36
8.4	Before 8.4.27	8.4.27
8.5	Before 8.5.12	8.5.12

PHP 8.1 and older are outside normal upstream support. PHP has supplied minimal source backports for 7.4, 8.0 and 8.1, while distributions and long-term-support vendors may provide packaged fixes. Owners of older installations should confirm coverage with their vendor or upgrade to a supported branch.

Could the PHP Vulnerabilities Affect WordPress Sites?

WordPress sites running affected PHP versions need the PHP fixes. The warning covers PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php the highest risk; exploitability varies with the server, application and configuration.

WordPress uses PHP to run its server-side code. As the WordPress Hosting Team explains, that code produces the response sent to a visitor. A fully updated WordPress installation can therefore still depend on vulnerable PHP software.

Successful exploitation could let attackers read or change files accessible to the PHP process. On a WordPress server, that could include application files or configuration containing database credentials. The damage would depend on file permissions and how the server separates sites.

PHP must be updated separately from WordPress. On shared or managed hosting, the provider supplies PHP updates through its settings or support team. On a self-managed server, the server administrator is responsible.

Providers Deploy Interim Protections

Cloudflare and CloudLinux have deployed firewall protections, while Prostack has changed its server configuration as a precaution. These measures do not replace the PHP security patches.

Cloudflare's initial rules target known exploit vectors for PHP sites behind its network. They are available to all customers, including those on free plans, according to Tenable's account of Knecht's statement. The rules inspect only traffic routed through Cloudflare, and Knecht warned that sites still need the PHP update.

Cloudflare's official firewall changelog records emergency changes to its Managed and Free rulesets on 21 October. However, those entries describe anomalous request patterns without naming PHP or either CVE.

CloudLinux has released firewall ruleset 8.83 for its Imunify360 server-security product to the Stable channel. Servers with Imunify360 and its ModSecurity firewall enabled receive the ruleset automatically.

CloudLinux says the rule targets a pattern involving PHP's session upload progress feature, which tracks incoming file uploads, and multipart requests, the format used for forms containing files. PHP's advisories now confirm that upload progress is involved in some attack paths, alongside other request-state problems.

CloudLinux calls the rule an interim mitigation, not a complete fix. PHP likewise says disabling upload progress blocks confirmed session paths but leaves other variants. CloudLinux now confirms fixed EasyApache and Alt-PHP packages are available, with availability varying by platform and repository.

Hosting provider Prostack has disabled PHP's upload progress feature and says it has also checked that automatic session startup is off across its servers. It now reports patched Cito and cPanel servers, including backports, while cPanel PHP versions below 7.4 still need an upgrade.

InterServer has verified Imunify360 ruleset 8.83 on all its webhosting servers. It says its DirectAdmin storage servers instead use the OWASP firewall ruleset. It has also disabled upload progress on shared hosting, and now confirms that all cPanel EasyApache PHP packages have been updated.

WordPress site owners should ask their host which fixed PHP build or backported package serves their site, and whether it has been applied. A firewall rule or configuration workaround does not remove the need for that update.

The WordPress logo reference comes from WordPress.org's official assets. WordPress is a registered trademark of the WordPress Foundation.

This report reflects information available on 22 October 2026 at 00:37 UTC, after PHP published the fixes and advisories.