PHP CVE-2026-109618: what to do for your WP site

Quick answer: CVE-2026-109618 is one of 2 critical flaws in PHP itself, not in WP or a plugin. The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and your host installs it. Check your PHP version, ask your host when it goes in, and move off PHP 8.1 or older.

Where CMSHands fits. CMSHands is a free plugin that adds a chat to your WP dashboard: the screens you log in to at yoursite.com/wp-admin. It names your PHP version in one question, and it checks a plugin's PHP needs before you move up. It can't install this fix. Only your host can.

The facts below are as of Oct 21, 2026, 14:15 UTC, from PHP's own security notice. We update this page as more is known.

What is CVE-2026-109618?

CVE-2026-109618 and CVE-2026-109619 are 2 security flaws in PHP, fixed on Oct 21, 2026. A CVE number is the public ID a security flaw gets, so everyone means the same one.

PHP's security team rates both 9.2 out of 10 on the CVSS scale, the usual score for how bad a flaw is. That counts as critical. PHP says both can let someone run their own code on a server, without logging in.

The first one goes wrong when PHP runs out of memory partway through a request. The second leaves leftovers from one visit that the next visit can misuse. You don't need the details: the fix is the same for both.

PHP says every server that runs PHP for a website is at risk, however it's set up. It shows a working attack that starts before your site's own code runs. Some reports call the pair PHP2Shell, after a tool that leaked on Oct 20.

Which PHP versions are affected?

Every version older than the fixed ones. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your PHP is 8.4.26, you need 8.4.27 or newer.

PHP 8.1 and older get no update from PHP. PHP published code fixes for 7.4, 8.0 and 8.1, but your host has to build and install them. Some hosts and Linux systems do that, so ask yours.

PHP 8.2 gets this fix, but its updates stop on Dec 31, 2026. If you're moving up, move to 8.3 or 8.4.

Is my WordPress site affected?

Yes, unless your host has installed the fix. The flaw is in PHP, which runs before WP does. Your WP version, your theme and your plugins don't change that.

It's also why a security plugin can't stop it. PHP's notice says the attack can start before your site's own code runs, plugins included.

Has anyone used it yet? On the morning of Oct 21, watchTowr and Beazley Security reported no attacks. Sansec cited early attacks that Cloudflare saw. Either way, the fix is what counts.

How do I check my site's PHP version?

In your WP dashboard, open Tools › Site Health, choose the Info tab and open Server. Look for the PHP version line.

Or ask CMSHands “Give me a quick health report.” It lists your WP and PHP versions and changes nothing. On our test site, a WP site we run to try every task before we write about it, it said PHP 8.4.26.

Compare your number with the fixed one for its branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Some hosts patch PHP and keep the old number, so if yours didn't change, ask them.

What should I do now?

1. Ask your host when they'll install the fix

On most hosting plans, your host updates PHP, not you. Send them this today:

“PHP released critical security fixes on Oct 21, 2026 (CVE-2026-109618 and CVE-2026-109619): PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. When will the fix be on the server my site runs on? My site is yoursite.com, on PHP [your version].”

Many hosts post updates like this on a status page or blog. If yours already has, you're done with this step.

2. On PHP 8.1 or older? Move up

Old PHP gets no fix from PHP. Ask your host to move your site to PHP 8.3 or 8.4. Many hosting panels let you pick it yourself, under a name like PHP version or PHP settings.

Check your plugins first. Each one lists the oldest PHP it needs, and a very old plugin may stop working on PHP 8. Check that a plugin works with your PHP version before you switch.

Make sure a recent copy of your whole site exists before the switch. Your host or a plugin makes it. If the site breaks on the new PHP, most panels let you pick the old version again while you sort it out.

3. After the fix, check your site

Open your home page and your busiest page. Then look at Tools › Site Health again: the PHP version should be the new one.

4. Running your own server?

If you look after the server yourself, install the PHP update from your Linux system's packages, then restart PHP. PHP says Linux systems got the fix in advance. If you use the Remi package source, PHP says it won't have the update today.

PHP lists stopgaps for a server you can't update yet, such as session.upload_progress.enabled=0 in php.ini. It also says none of them makes a server safe. Only the update does.

Can CMSHands protect my site from this?

No. This flaw is in PHP on your host's server, and CMSHands works inside WP. It can't install PHP updates, change your PHP version or block attacks.

Here's where it does help:

It names your PHP version. Ask “Give me a quick health report.” and it lists your WP and PHP versions.

It checks your plugins before a PHP move. It reads a plugin's own PHP requirement and names both versions, so you know before you ask your host.

It watches the site after the change. With your email, it checks your site once a day on the free plan, and at once if it crashes. If the new PHP upsets a plugin, ask “What are the errors on my site?” and it reads your error log.

It can't tell you whether someone already used the flaw on your server. That's in your host's logs, so ask them.

If your site breaks

If CMSHands was on your site before it broke, we find the cause and prepare a fix. A person at CMSHands approves it before it runs.

It can't be installed into a site that won't load, so install it while your site works.

Where these facts come from

PHP's security notice and its 4 release notes on php.net, Oct 21, 2026, with the 2 advisories they link (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp). Attack reports: watchTowr's CVE-2026-109618 FAQ, Beazley Security's advisory BSL-A1233 and Sansec's “PHP2Shell” research, all read Oct 21, 2026.