PHP sites need the October 2026 security update. WordPress updates do not fix it.
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619. The UK National Cyber Security Centre says the issue can allow unauthenticated remote code execution and that older PHP should move to a supported release. Updating WordPress does not patch PHP.
Request a PHP exposure check · Call (219) 276-1490
What was published
The PHP project says both flaws can allow unauthenticated remote code execution on installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where a request can reach the flaw before application code runs. PHP 8.1 and older no longer receive routine security updates from the PHP project. Some vendors may backport fixes. PHP 8.2 reaches end of support on 31 December 2026. Sources: PHP security advisory, UK NCSC alert, and WordPress.org notice.
What AskBuc recommends
Find every internet-facing site and appliance that runs PHP, including WordPress, Laravel, Magento, custom apps, and control panels. Confirm the exact PHP version in hosting, not only inside WordPress Site Health. Move supported branches to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a later vendor package that includes those fixes. If the host cannot patch promptly, follow the public agency advice and consider taking that system offline until it can. Temporary settings published by PHP reduce some paths. They are not a complete fix. Do not treat a content-management-system update as the PHP update.
What AskBuc can do
Exposure check. Inventory sites, PHP versions, hosting control, and whether the site is internet-facing. This is a records and configuration review, not a self-serve exploit scan.\n\nPatch and compatibility window. Apply the vendor or host package, test the application, and record what changed. Plugin or theme breakage is checked before the window closes.\n\nCompromise review. If the site was exposed before the update, look for unexpected admin users, unfamiliar files, and changed scheduled tasks. A clean visual homepage is not proof the server is clean. This is not a full forensic investigation.\n\nStay-current retainer. Monthly PHP, CMS, plugin, and host-package review so the next emergency is a planned window, not a surprise.
Questions owners ask
Does updating WordPress fix this? No. WordPress.org said no WordPress update is required or planned because the flaws are in PHP itself.\n\nAre only old PHP versions affected? No. The PHP project told every current supported branch to update. Older branches need a vendor backport or an upgrade.\n\nIs a firewall rule enough? A host may add filtering. The published advice is still to update. Filtering is not a substitute for the fixed PHP release.\n\nCan AskBuc guarantee the site was not reached? No. We can check the agreed systems and report what was observed. Absence of an obvious change is not proof that nothing happened.