> PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now

The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The PHP project says all PHP users are strongly encouraged to update immediately. We recommend making sure every site you manage is running a patched version of PHP as soon as possible. Remote code execution means an attacker could run their own code on your server. “Unauthenticated” means they would not need to log in first. In its advance notice on October 20, the PHP security team rated both vulnerabilities 9.2 on the CVSS v4.0 scale, which falls in the Critical range. Every WordPress site runs on PHP. These are vulnerabilities in PHP itself, not in WordPress, a plugin, or a theme, so WordPress automatic updates will not fix them. PHP has to be updated on the server. The Wordfence Threat Intelligence team is investigating these vulnerabilities, and we will be posting updates as necessary. Who Is Affected According to the PHP security advisory, all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP project considers the risk highest for mod_php, where it has a demonstrated exploit in which an unauthenticated request can trigger the attack before any application code runs. Fixed Versions PHP 8.5: update to 8.5.12 PHP 8.4: update to 8.4.27 PHP 8.3: update to 8.3.36 PHP 8.2: update to 8.2.35. The PHP project says PHP 8.2 reaches end of life on December 31, 2026, and will receive no security fixes after that date. PHP 8.1 and older no longer receive updates from the PHP project. The PHP project says some Linux distributions and long-term support (LTS) vendors provide backported fixes, so contact your vendor, or upgrade to a supported version. The PHP security team has also published minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1 for people who build PHP from source or don’t have access to an LTS vendor. What to Do Now Check your PHP version. In your WordPress dashboard, go to Tools > Site Health, open the Info tab, and expand the Server section. If your PHP comes from a Linux distribution or LTS vendor, the version number may not change after patching, so confirm with your host or your vendor’s security notice. If your hosting provider manages PHP for you, contact them or check their status page to confirm they have updated to one of the fixed versions. If you manage your own server, make a backup, then install the updated PHP packages from your Linux distribution or LTS vendor. The PHP project says these vendors received the patches in advance. Source downloads and Windows source and binaries are on the PHP downloads page. If you use the volunteer-maintained remirepo repository (rpms.remirepo.net), check it for updated packages. The PHP security advisory said the repository would not have updates on October 21, but the PHP Foundation has since posted that its maintainer is now signing updated packages. The advisory also urges remirepo users to switch to distribution packages or build from source so they can apply updates immediately. If You Can’t Update Immediately The PHP project says only an update is a complete solution. For anyone who cannot update immediately, its advisory lists measures that reduce exposure to specific attack paths but do not make an installation safe. If you or your host need them, follow the exact instructions in the PHP security advisory. Need Help? Wordfence Care and Wordfence Response customers can contact our incident response team if they need help. Wordfence Care includes incident response during business hours, while Wordfence Response provides 24/7/365 availability with a one-hour response time. Get Incident Response Help The post PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now appeared first on Wordfence.