On October 21, 2026, the PHP project disclosed two critical vulnerabilities that can allow unauthenticated remote code execution on affected web servers. Both vulnerabilities received a CVSS v4.0 score of 9.2.
CVE-2026-109618 CVE-2026-109619
Pagely deployed initial mitigations while preparing updated PHP containers, then completed the rollout of the full security fixes across customer servers. No further action is required from Pagely customers for this PHP update.
The patched PHP releases are:
What was disclosed?
Both vulnerabilities affect PHP itself rather than WordPress core, a plugin, or a theme.
CVE-2026-109618 involves PHP’s handling of out-of-memory conditions. Request processing can be interrupted while internal data is only partially initialized, after which PHP may treat that incomplete data as valid during cleanup. The resulting memory corruption can create a path to remote code execution.
CVE-2026-109619 involves stale internal state. A PHP worker can retain a reference to request data after the underlying memory has been released. A later request handled by the same worker may access that stale information before normal initialization resets it, potentially leading to information disclosure or remote code execution.
Because the vulnerabilities exist in the PHP runtime, updating WordPress or its extensions
