Your website can look completely normal while the software running behind it needs an urgent security update.
On October 21, 2026, the PHP project released emergency updates addressing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Under certain conditions, these flaws can allow an attacker to execute code on a server without logging in. Both received a critical severity rating of 9.2 out of 10 under CVSS v4.0.
For business owners, the priority is to confirm whether their hosting environment has received the relevant fixes.
How Were These Vulnerabilities Discovered?
The investigation developed over several years.
According to the PHP Foundation, the first signs of the memory-handling problem behind CVE-2026-109618 emerged during work following a security audit in 2024. At that stage, developers suspected it might be exploitable but had not identified a concrete attack path.
In August 2026, researcher Ryan A at security company Calif reported remote code execution linked to the same underlying problem. Independent reports and additional attack paths from OpenAI and Wiz helped establish its full impact. Fixing the issue then became the Foundation security team’s highest priority.
This discovery came from security researchers and PHP maintainers. For website owners and developers, the next responsibility is turning those findings into verified protection.
What Is the Actual Issue?
The vulnerabilities affect how PHP manages memory and internal information while processing web requests.
CVE-2026-109618: Problems When PHP Runs Out of Memory
When PHP reaches a memory limit at a particular point, it can leave internal request information only partly prepared. During cleanup, PHP may incorrectly treat that information as valid.
This memory corruption can lead to remote code execution. PHP reported a demonstrated attack against Apache with mod_php that can happen before the website’s application code runs.
CVE-2026-109619: Leftover State Between Requests
The second vulnerability involves internal state surviving after the memory behind it has been freed. A later request processed by the same PHP worker may use that invalid state.
Depending on the application and server conditions, this can cause crashes or enable remote code execution.
In practical terms, these are flaws in the PHP runtime underneath a website.
Could My WordPress or WooCommerce Website Be Affected?
WordPress and WooCommerce run on PHP, so checking the hosting environment matters alongside updating the website itself.
PHP’s advisory identifies installations serving web requests as at risk, including PHP-FPM, Apache with mod_php, PHP-CGI, FrankenPHP and LiteSpeed. Actual exploitability depends on the environment and application behaviour.
Being potentially vulnerable does not prove your website has been hacked. It means you need to establish whether the relevant fixes are installed and investigate any signs of compromise.
Updating a theme or plugin alone does not establish that the underlying PHP installation has been patched.
How Is the PHP Team Fixing the Problem?
The PHP project released the following security updates on October 21:
| PHP branch | Release containing the October 21 fixes |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Hosting and operating-system vendors may also supply backported fixes. Ask your provider to confirm the exact package and patch status, particularly if its version number differs from this table. PHP states that temporary mitigations do not replace updating.
PHP 8.1 and older no longer receive regular updates from the PHP project. If your website runs an older branch, confirm vendor-provided security fixes or plan an upgrade to a supported version.
The Foundation has also acknowledged delays in resolving the original problem. It describes changes to security decision-making, additional engineering support and stronger coordination intended to help complex fixes move forward sooner.
The October 23 Follow-Up Also Matters
PHP’s October 23 notice recommended disabling session.upload_progress.enabled until the next regular bugfix release to address an additional, unusual remote-code-execution path. PHP tracks this follow-up as CVE-2026-115560.
This involves a specific combination of session configuration and application code that switches session serialization handlers at runtime. Applications that never make that switch can keep the feature enabled, according to PHP. Your developer or hosting provider should review whether this applies to your environment.
How I Can Help Protect Your Website
Through Ecommerce101, I help businesses manage the technical work involved in securing and maintaining their WordPress and WooCommerce websites.
For this PHP security issue, that support can include:
Checking Your Hosting Environment
I can review the PHP version serving your website and work with your hosting provider to confirm whether the relevant security fixes have been applied.
Preparing for Updates
I can check backups, identify compatibility concerns and plan the update around the website’s operational needs.
Testing Your Store
After an update, I can test essential journeys such as product pages, customer login, forms, cart and checkout, and review application errors.
Reviewing Suspicious Activity
Where logs and access are available, I can review unexpected errors, file changes and other warning signs, and help determine whether further investigation is needed.
Planning Ongoing Maintenance
I can help establish a maintenance routine covering supported software versions, backups, updates and monitoring.
The aim is to make security work understandable, documented and connected to the everyday operation of your business.
What Should You Do Now?
Start by asking your hosting provider:
“Have you applied fixes for CVE-2026-109618 and CVE-2026-109619 to the PHP installation serving my website, and have you reviewed PHP’s October 23 session upload progress advisory?”
Then arrange any necessary updates, test the website’s key functions and keep a record of the work completed.
Need Help Checking Your Website?
If you’re unsure which PHP version your website uses or whether your host has applied the fixes, I can help you establish what needs attention.
Visit Ecommerce101.ca to discuss a WordPress or WooCommerce security and maintenance review.
Official references
- PHP security announcements and October 23 session upload progress notice
- PHP Foundation: Discovery, fixes and security improvements
- CVE-2026-109618 advisory
- CVE-2026-109619 advisory
Information checked on October 25, 2026. Consult the official advisories for subsequent updates.