If you run a WordPress site, there’s a security update worth checking with your host today. On October 21, the PHP development team released emergency fixes for two critical vulnerabilities that could allow an attacker to run code on a vulnerable web server without first logging in. On October 23, the team followed up with a narrower advisory about an unusual session configuration.
PHP is the programming language behind WordPress and countless other websites. Most site owners never need to touch it directly, which is exactly why a serious PHP issue can be easy to overlook: the dashboard may look normal while the important version number lives in the hosting account.
Which PHP versions have the emergency fixes?
According to the PHP project’s October 21 security advisory, the fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. They involve internal memory handling and request state, rather than a WordPress password or a particular plugin.
The PHP team warns that installations serving web requests can be affected across common setups, including PHP-FPM, Apache’s PHP module, php-cgi, FrankenPHP and LiteSpeed. It specifically identifies Apache mod_php as a high-risk configuration. The team also says there is no complete substitute for updating to a fixed release.
What WordPress owners should check
Start with the version your website is actually using, not the version advertised in a hosting plan. In WordPress, go to Tools → Site Health → Info → Server and look for the PHP version. If you’re using a managed host, its control panel or support team should also be able to confirm the live version and whether a vendor backport has been applied.
If your site is running an earlier release in one of the affected branches, contact your host or schedule an update promptly. Take a verified backup first, and check important functions afterward: login, contact forms, checkout and any scheduled tasks. A version upgrade can expose compatibility problems in older themes or plugins, so testing still matters even when the security update is urgent.
Don’t assume that installing the latest WordPress core update also updates PHP. They are separate pieces of software, often maintained in different places. Likewise, adding a security plugin does not replace a fix to the underlying runtime.
There’s also an October 23 follow-up
On October 23, the PHP project published additional guidance concerning session upload progress. It recommends setting session.upload_progress.enabled=0 until a future regular bug-fix release, to guard against an unlikely code-execution path that requires an unusual combination of application settings and runtime behaviour.
The team says the scenario involves applications that configure the session serialization handler as php_binary or php_serialize, switch it to php during execution, and then call session_start() while upload progress remains enabled. Applications that never make that runtime switch can keep the feature enabled, according to the advisory. The team says it plans a fuller advisory under CVE-2026-115560 with the next release.
For a typical small-business site, this is a good reason to ask a hosting provider what it has checked—not a reason to paste unfamiliar server directives into a live site. The immediate priority remains confirming the October 21 security patches, followed by a review of the new October 23 guidance where applicable.
Five minutes now can save a difficult weekend
Security advice often sounds abstract until it lands on a business that relies on its website for orders, bookings or customer messages. This one has a practical starting point: find your PHP version, compare it with the fixed releases, and get a clear answer from your host if anything is uncertain.
There is no need to panic or assume a site has been compromised simply because it ran an older version. But there is every reason to treat the update as a priority, document what changed, and make sure the site still works afterward.
Source: PHP project’s official October 21 security release and October 23 follow-up advisory.
