On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website traffic. We first alerted WordPress site owners to these updates in our initial public service announcement. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and each has a CVSS v4.0 score of 9.2 out of 10.
These are not vulnerabilities in WordPress Core, a plugin, or a theme. They are vulnerabilities in PHP, the programming language WordPress uses. Updating WordPress will not install the fixes. On most shared and managed hosting,
