The PHP security team has issued advance notice of an upcoming critical security release, scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern). The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale. PHP is the programming language WordPress is built on.
PSA: Upcoming Critical PHP Security Release
About this summary. This is a short excerpt from the description that Wordfence published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.wordfence.com/blog/2026/10/psa-upcoming-critical-php-security-release/
Source attribution: headline and facts are from Wordfence (wordfence.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Last week, there were 497 vulnerabilities disclosed in 327 WordPress Plugins and 23 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability…
Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners…
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote…
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP…
CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks
IntroductionOn October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,”…
Today's PHP Security Release, and How We're Strengthening PHP Security
Today's PHP Security Release, and How We're Strengthening PHP Security If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP…