Written by Ajesh Unnithan
Two critical vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619—have created an urgent security problem for businesses running WordPress, WooCommerce and other PHP-based applications.
These are not ordinary WordPress plugin vulnerabilities. They exist inside the PHP engine that processes website requests. A fully updated WordPress installation could therefore remain exposed if the server uses a vulnerable PHP build.
Where were the vulnerabilities found?
Both vulnerabilities concern how PHP manages memory when a request fails unexpectedly.
CVE-2026-109618 can corrupt memory when PHP reaches its configured memory limit while processing a request. CVE-2026-109619 can leave internal data referring to memory that has already been released. A later request handled by the same worker may reuse that stale information.
Successful exploitation could let an unauthenticated attacker run code on the server or read process memory containing passwords, authentication tokens, API keys or other sensitive information. The risk applies to common configurations including PHP-FPM, CGI, LiteSpeed and Apache mod_php.
Who discovered and reported the problem?
The history began before the current emergency. According to the PHP Foundation, a security researcher identified early signs of one underlying problem in 2024. Its practical exploitation had not yet been demonstrated, and the issue was not resolved. The Foundation later characterised this delay as a structural failure.
Further research by Calif, OpenAI and Wiz demonstrated how the weaknesses could become working attacks. Wiz credits researchers Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz, alongside the PHP team and other organisations involved in discovery, coordination and patch verification.
AI models reportedly helped researchers analyse the code, develop and test exploits, create detections and verify the eventual correction. PHP released emergency fixes on 21 October 2026.
Which PHP versions are safe?
The corrected upstream releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 5.4 through 8.5.11 may be affected. PHP 8.1 and earlier are outside normal upstream support, although certain operating-system or commercial vendors may supply backported corrections.
Checking only whether a website uses “PHP 8.2” is insufficient. The complete version or vendor package must contain the security patch.
How should different servers be updated?
First create a tested backup of the website files and database. Then identify who controls PHP:
- Managed or shared hosting: Ask the host to confirm in writing that every PHP handler serving the domain has been patched.
- cPanel hosting: Check the domain in MultiPHP Manager. VPS administrators should install the corrected EasyApache packages and confirm the package changelog includes the CVE fix.
- Plesk VPS: Update PHP packages through Plesk’s update tools, then inspect each domain under PHP Settings. Check staging sites and subdomains separately.
- Ubuntu or Debian: Install the corrected packages from the operating-system or approved PHP repository, then restart the relevant PHP-FPM and web-server services.
- AlmaLinux, Rocky Linux or RHEL: Apply the corrected distribution or supported vendor packages.
- Docker: Rebuild and redeploy the application using a patched base image. Restarting an existing vulnerable container is not enough.
Afterward, test logins, contact forms, uploads, WooCommerce checkout, scheduled tasks, payment integrations and other business-critical functions.
How can a business tell whether it was attacked?
Updating prevents future exploitation of these flaws, but it cannot prove the server was not compromised earlier. A proper review should examine:
- Web-server access and error logs for unusual requests, uploads and repeated memory errors
- Recently created or modified PHP files, particularly inside upload directories
- Unexpected WordPress administrators, cron jobs or scheduled tasks
- Changes to
wp-config.php,.htaccess, plugins, themes and core files - Unrecognised server users, processes, outbound connections or SSH activity
- Altered payment settings, injected database content or unfamiliar API keys
- Redirects, spam pages and Google Search Console security warnings
No single clean malware scan can provide certainty. If suspicious activity is found, isolate the website, preserve logs, obtain a forensic review and rotate hosting, WordPress, database, SFTP, email and API credentials. Revoke active sessions and determine whether restoration from a known-clean backup is necessary.
Are patched websites now safe?
A business can reasonably say that its exposure has been reduced only after every production, staging and forgotten subdomain has been patched and checked. A CDN or web application firewall may reduce certain attack paths, but it is not a substitute for updating PHP.
CERT-EU states that only an update fully resolves these vulnerabilities. If patching cannot be completed promptly, the affected internet-facing service should be isolated until the correction is applied and verified.
Businesses needing help assessing their website, tracking or digital infrastructure can contact Ajesh Unnithan or email mail@ajeshunnithan.com.
0 Comments