PHP has various global state that temporarily points into request memory
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The PHP project says all PHP users are strongly encouraged to update immediately. We recommend making sure every site you manage is running a patched version of PHP as soon as possible.
Remote code execution means an attacker could run their own code on your server. “Unauthenticated” means they would not need to log in first. In its advance notice on October 20, the PHP security team rated both vulnerabilities 9.2 on the CVSS v4.0 scale, which falls in the Critical range.
Every WordPress site runs on PHP. These are vulnerabilities in PHP itself, not in WordPress, a plugin, or a theme, so WordPress automatic updates will not fix them. PHP has to be updated on the server.
The Wordfence Threat Intelligence team is investigating these vulnerabilities, and we will be posting updates as necessary.
Who Is Affected
According to the PHP security advisory, all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP project considers the risk highest for mod_php, where it has a demonstrated exploit in which an unauthenticated request can trigger the attack before any application code runs.
Fixed Versions
PHP 8.5: update to 8.5.12
PHP 8.4: update to 8.4.27
PHP 8.3: update to 8.3.36
PHP 8.2: update to 8.2.35. The PHP project says PHP 8.2 reaches end of life on December 31, 2026, and will receive no security fixes after that date.
PHP 8.1 and older no longer receive updates from the PHP project. The PHP project says some Linux distributions and long-term support (LTS) vendors provide backported fixes, so contact your vendor, or upgrade to a supported version. The PHP security team has also published minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1 for people who build PHP from source or don’t have access to an LTS vendor.
What to Do Now
Check your PHP version. In your WordPress dashboard, go to Tools > Site Health, open the Info tab, and expand the Server section. If your PHP comes from a Linux distribution or LTS vendor, the version number may not change after patching, so confirm with your host or your vendor’s security notice.
If your hosting provider manages PHP for you, contact them or check their status page to confirm they have updated to one of the fixed versions.
If you manage your own server, make a backup, then install the updated PHP packages from your Linux distribution or LTS vendor. The PHP project says these vendors received the patches in advance. Source downloads and Windows source and binaries are on the PHP downloads page.
If you use the volunteer-maintained remirepo repository (rpms.remirepo.net), check it for updated packages. The PHP security advisory said the repository would not have updates on October 21, but the PHP Foundation has since posted that its maintainer is now signing updated packages. The advisory also urges remirepo users to switch to distribution packages or build from source so they can apply updates immediately.
If You Can’t Update Immediately
The PHP project says only an update is a complete solution. For anyone who cannot update immediately, its advisory lists measures that reduce exposure to specific attack paths but do not make an installation safe. If you or your host need them, follow the exact instructions in the PHP security advisory.
Need Help?
Wordfence Care and Wordfence Response customers can contact our incident response team if they need help. Wordfence Care includes incident response during business hours, while Wordfence Response provides 24/7/365 availability with a one-hour response time.
Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.
Our business hours are 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays.
Response customers receive 24-hour support, 365 days a year, with a 1-hour response time.
This website uses cookies, pixels, and similar technologies (collectively “Cookies”) to improve your browsing experience. By clicking “Accept All”, you agree to the storing of Cookies on your device and that we may share, track, store, and analyze your interactions with the website to enhance site navigation, analyze site usage, and assist in our marketing efforts. For more information on our use of cookies please review our Cookie Policy.
Cookie Settings Accept All Reject All
Cookie Options
For additional information on how this site uses cookies, please review our Privacy Policy. The cookies used by this site are classified into the following categories and can be configured below.
Strictly Necessary
Always active
The “Strictly Necessary” cookies are necessary for the Sites and Services to work properly, and cannot be disabled. They include any essential authentication and authorization cookies for the Services. If you select the “Reject All” button, or choose to do nothing, only the strictly necessary cookies are active by default.
Functional
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These cookies allow us to remember choices you make, such as your username, language, or region. This helps provide a more personalized and consistent experience by tailoring the Services to your preferences. For example, we can remember your preferred settings or login details, so you don't have to re-enter them each time you visit.
Performance/Analytical
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These Cookies allow us to collect certain information about how you navigate the Sites or utilize the Services running on your device. They help us understand which areas you use and what we can do to improve them.
Targeting
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These Cookies are used to deliver relevant information related to the Services to an identified machine or other device (not a named or otherwise identifiable person) which has previously been used to visit our Sites. Some of these types of Cookies on our Sites are operated by third parties with our permission and are used to identify advertising sources that are effectively driving customers to our Sites.
Cancel Save
Do Not Sell or Share My Personal Information
This form enables you to request that we stop selling or sharing your personal information with third parties. "Selling" includes exchanging your information for money or other benefits, while "sharing" refers to providing your data to third parties for targeted advertising purposes. For more information on how we process personal information, please review our Privacy Notice.
When you submit this form, we will:
Immediately disable retargeting and remarketing cookies on your current browser/device
Browser/Device Specific: This opt-out applies to the specific browser from which you submit the request. To opt out on additional devices or browsers, you will need to submit separate requests.
Cookie Management: You may also manage cookies directly through your browser settings, or on our Cookie Control form.
Do Not Sell or Share My Personal Information
Stop selling personal information about me to third parties for monetary or other valuable consideration.
Stop sharing personal information about me with third parties for cross-context behavioral advertising.
Your request has been received. We will no longer share or sell your personal information on this browser.
Cancel Submit
An error occurred while attempting to submit your request. Please try again or contact support.
Brad Osborne
Akamai Blog