On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases. At this time, we have not observed any confirmed compromises resulting from these vulnerabilities, which is a clear indicator of this exploit’s complexity considering Wordfence secures over 5,000,000 WordPress websites.
Through our built-in firewall protections, the Wordfence Firewall has already intercepted over 74,000 exploit or probing attempts associated with the newly disclosed
