Quick answer
Ask your host to confirm that both PHP fixes are active; WordPress updates alone do not install them. Find your version under Tools → Site Health → Info → Server → PHP version. If it is older than the fixed release, ask about vendor backports. Also ask whether PHP’s 23 Oct follow-up notice applies.
The 21 Oct 2026 PHP releases address two critical flaws in the software that runs WordPress. WordPress’s security notice says no WordPress update is required or planned for these issues. The checks below help you establish whether your site is running patched PHP.
What the PHP update fixes
The PHP project’s advisory identifies two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow an attacker to execute code remotely without authentication. PHP is the server-side software that runs WordPress.
The PHP Foundation’s explanation describes faults in memory management and error handling. The conditions matter: this is not a claim that every WordPress site can be exploited in the same way. PHP’s advisory includes PHP-FPM among the affected deployment types, so using nginx with PHP-FPM does not remove the need to patch.
These are the upstream PHP releases announced on 21 Oct 2026 with both fixes. Use these releases or a later patched release in the same branch; vendor-maintained builds require the additional check below.
| PHP branch | First fixed release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Follow-up, 23 Oct: PHP has since issued an informational notice about an additional, unlikely remote-code-execution path involving session upload progress (CVE-2026-115560). It requires an unusual combination of configuration and application behavior; PHP plans a fix in its next regular bugfix release. Ask your host whether this follow-up applies to your site and whether PHP’s interim guidance is needed. The releases above address the original two vulnerabilities, so their version numbers alone do not resolve this separate question.
Follow-up, 26 Oct: PHP’s updated Windows packages (8.2.35-1, 8.3.36-1, 8.4.27-1 and 8.5.12-1) include Brotli 1.2.1 to fix a separate decompression vulnerability. The PHP runtime version stays unchanged, so Windows administrators should verify the package build as well as the version. The affected decoder can be reached through PHP’s cURL extension when automatic HTTP response decompression is enabled; this is off by default, but applications can enable it.
Check the PHP version your site actually runs
- Sign in to your WordPress dashboard as an administrator. Open Tools → Site Health, choose Info, then expand Server and find PHP version.
- Record the full version and when you checked it. Compare it with the fixed release for that branch.
- Check the hosting dashboard’s PHP or server settings for this specific site. A selector that only says “PHP 8.4” does not identify the installed patch release; ask support for the full version or package build.
The WordPress notice confirms the Site Health menu path; its Site Health documentation explains the Info screen. If you cannot access this information, request it from your host. You do not need to install another plugin just to ask for confirmation.
A site that still loads has passed a basic availability check. That observation tells you nothing about whether these PHP fixes have been installed.
Ask your host about backports and active workers
Some vendors apply security fixes to an older software version while keeping its upstream version number. Red Hat explains this practice as backporting. An apparently older PHP number therefore needs a vendor advisory or package-build check before you can establish its status.
For example, AlmaLinux’s release notice tells administrators to compare installed package builds with its patched-package list and restart PHP-FPM or Apache as applicable. A package being available for download is different from the patched runtime serving your site.
Ask support to confirm the following for your domain:
- Whether both CVE-2026-109618 and CVE-2026-109619 are fixed in the PHP runtime serving the site.
- The installed PHP version and full vendor package/build identifier, plus the relevant security advisory if fixes were backported.
- When the fixes became active, whether the required worker restart or replacement is complete, and whether you need to take any further action.
PHP 8.1 and older no longer receive regular updates from the PHP project. Its advisory notes that some distributions and long-term-support vendors provide backports. If that applies to your site, obtain explicit confirmation for both CVEs and discuss moving to a supported branch.
Patching and investigating a compromise are separate jobs
A patched PHP runtime addresses these vulnerabilities going forward. It does not prove that a site was never compromised or remove changes an attacker may already have made.
If you notice unexplained administrator accounts, redirects or other unauthorized changes, document what happened and contact your host for an investigation. WordPress’s compromised-site guidance covers recording symptoms and involving the hosting provider. Keep the patch confirmation and any incident investigation as separate records.
Evidence level: Researched. Sources checked 27 Oct 2026. Elegant Matter has not reproduced an exploit or investigated whether a particular site was compromised.