Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found

Reported by Wordfence (Alex Thomas)

Summary by Cyber Security News22 Oct 2026, 02:51 CET

About this summary. This is a short excerpt from the description that Wordfence published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.wordfence.com/blog/2026/10/critical-php-update-wordpress-vulnerabilities-testing/

On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website traffic. We first alerted WordPress site owners to these updates in our initial public service announcement. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and each has a CVSS v4.0 score of 9.2 out of 10.

Read the full article at Wordfence →

Source attribution: headline and facts are from Wordfence (wordfence.com). Summary method: excerpt of the source description. See our source attribution policy.