PHP SECURITY UPDATE FOR ALL INTERNET SERVERS

UPDATE NOW: The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution.
Read The Full Post Here
The PHP project says all PHP users are strongly encouraged to updateimmediately. We recommend making sure every site you manage is running apatched version of PHP as soon as possible.
Remote code execution means an attacker could run their own code on your server.“Unauthenticated” means they would not need to log in first. In its advance notice onOctober 20, the PHP security team rated both vulnerabilities 9.2 on the CVSS v4.0scale, which falls in the Critical range.
Every WordPress site runs on PHP. These are vulnerabilities in PHP itself, notin WordPress, a plugin, or a theme, so WordPress automatic updates will notfix them. PHP has to be updated on the server.
Who is affected:
According to the
PHP security advisory
, all PHP installationsserving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP project considers the risk highest formod_php, where it has a demonstrated exploit in which an unauthenticated requestcan trigger the attack before any application code runs.
Fixed versions:
PHP 8.5:
update to 8.5.12
PHP 8.4:
update to 8.4.27
PHP 8.3:
update to 8.3.36
PHP 8.2:
update to 8.2.35. The PHP project says PHP 8.2 reaches end of lifeon December 31, 2026, and will receive no security fixes after that date.