Critical PHP Remote Code Execution Vulnerabilities - Project A Inc.

On October 21, 2026, the PHP project released security updates for two critical vulnerabilities that could allow attackers to run code on a web server without logging in. Project A has completed patching for affected hosting systems. Our hosting customers do not need to take any action to apply these updates.

Here is what happened, what it means for WordPress sites, and how we responded.

The PHP security team gave advance notice on October 20 that a critical security release was coming. The updates arrived on October 21 and addressed two vulnerabilities:

CVE-2026-109618: A flaw in how PHP handles memory exhaustion can leave internal data in an invalid state, potentially allowing an attacker to run code on the server.

CVE-2026-109619: A flaw in how PHP clears data between requests can cause it to reuse invalid data, potentially allowing an attacker to run code on the server.

Both vulnerabilities were rated 9.2 out of 10 on the CVSS v4.0 severity scale, placing them in the Critical range. Neither requires an attacker to log in.

Why this matters for WordPress sites

WordPress runs on PHP, but PHP is maintained separately from WordPress and is usually managed by your hosting provider. That has two practical consequences:

WordPress automatic updates will not apply this fix. Updating WordPress, your plugins, or your themes does not update the PHP software running on your server.

Responsibility depends on your hosting arrangement. On most managed and shared hosting plans, your provider handles PHP updates. If you administer your own server, you or your server administrator are responsible for applying them.

We received security notifications before the fixes became available and prepared to apply the updates. Our response included:

Identifying affected systems and the sites running on them.

Ensuring backups were in place in case a restore was needed.

Applying recommended temporary mitigations while awaiting the patches.

Updating PHP on all affected servers we manage as quickly as possible after the releases became available.

Continuing to monitor for suspicious activity and further security developments.

The PHP project emphasized that temporary mitigations could reduce exposure to specific attack paths but could not fully resolve the vulnerabilities. Applying the updates was essential.

As of October 23, 2026, we have found no evidence of compromises related to these vulnerabilities on the systems we manage. Our monitoring continues.

On October 23, the PHP project also published an informational advisory a related issue involving session upload progress, tracked as CVE-2026-115560 . It requires an unusual combination of server settings and application behavior. PHP recommends temporarily disabling session upload progress unless the application is known to be unaffected, with a full advisory and fix planned for the regular release.

We are tracking this follow-up advisory as part of our ongoing security monitoring.

Project A hosting customers: No action is needed from you to apply the October 21 PHP security updates. We have completed patching and continue to monitor for developments.

If your site is hosted elsewhere: Ask your hosting provider to confirm that the PHP security updates have been applied and that the October 23 follow-up advisory has been addressed. If you manage your own server, review the PHP advisories and apply the appropriate updates and configuration changes.

Keeping the software behind your website updated is part of our hosting service. We continue to prioritize timely security updates, reliable backups, and ongoing monitoring.

Sources: PHP security advisory, October 21, 2026 , and the October 23 session upload progress advisory in PHP’s news archive .