Critical PHP vulnerabilities: what WordPress and cPanel site owners must do

On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. The issues, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 under CVSS v4.0. They affect PHP itself, which means that updating WordPress, WooCommerce, or a security plugin is not sufficient.

What are the two PHP vulnerabilities?

Both issues concern PHP's internal request processing rather than a particular CMS or plugin. The PHP security team considers all installations serving web requests potentially exposed, including PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP. It identified the highest risk in Apache mod_php, where a demonstrated unauthenticated attack can be triggered before application code runs.

These are serious flaws, but an affected server is not automatically a compromised server. Exploitability depends on runtime conditions, and the existence of a patch alone does not establish that a particular website was attacked.

Which PHP versions are patched?

The PHP project's October 21 security releases are:

Older branches do not receive normal security releases from the PHP project. Some Linux distributions and extended-support providers offer backported fixes; in that case the version may look old while the vendor package has been patched. Verify against the package build and your vendor's security notice, not the version string alone. For unsupported versions with no backport, plan an urgent migration.

What does this mean for WordPress and WooCommerce?

WordPress has explicitly confirmed that these vulnerabilities are not WordPress Core issuesand that no WordPress update is required or planned to fix them. A fully updated WordPress installation can still run on vulnerable PHP.

To check your website, open WordPress → Tools → Site Health → Info → Serverand note the PHP version. Then verify with your hosting provider whether that version's security patch has actually been installed.

For a WooCommerce store, arrange the PHP update promptly while preserving a usable backup. Afterward, verify frontend pages, wp-admin, login, checkout, payment methods, order creation, transactional emails, subscription renewals and custom integrations. Our WooCommerce maintenance checklistcovers the post-update checks in greater detail.

How to patch PHP in WHM/cPanel

cPanel published patches on October 21 for both its internal PHP and the EasyApache 4 PHP packages that serve websites. These are distinct components: updating the cPanel interface alone is not proof that every website's PHP runtime has been patched.

1. Back up and check the update window. Confirm recoverable backups and identify critical applications before changing server packages.
2. Update cPanel & WHM. As root, run the normal cPanel update process through WHM or follow cPanel's documented update procedure.
3. Apply EasyApache security packages. cPanel specifically documents /scripts/rpmup to update its EasyApache PHP RPMs.
4. Verify every installed PHP branch. Multiple sites may use different PHP versions. Confirm the package changelog records the CVE fix for each one, then confirm services and sites are operating normally.

For example, cPanel documents this command to check the PHP 8.1 CLI package changelog:

Replace php81 with the installed branch when appropriate. The official cPanel advisory lists fixed EasyApache builds for PHP 7.4 through PHP 8.5, including backports for PHP 7.4, 8.0 and 8.1. Versions older than PHP 7.4 require a separate support or migration plan.

If you use managed hosting, do not run server administration commands unless that is part of your role. Ask your provider which exact patched runtime or vendor package is active on your site and when it was installed.

Can a WAF or a security plugin protect you?

WordPress notes that hosts may be deploying web application firewall rules to reduce exposure. Those rules can be useful as an additional layer, but the PHP team says no complete mitigation exists without installing the security update. A WordPress security plugin, Cloudflare WAF rule or disabled plugin does not repair PHP's underlying memory handling.

Avoid treating temporary configuration workarounds as equivalent to a patch. They may only block specific known attack paths, can introduce operational side effects and do not establish that the server is safe.

What should you do if you cannot patch immediately?

Contact your host or server administrator urgently. Ask for the expected package update, whether a supported vendor backport exists, and what temporary exposure-reduction measures are available. For high-risk public-facing systems without a viable immediate fix, temporarily taking the affected service offline may be the safer option; national cybersecurity guidance referenced by WordPress explicitly recognizes that possibility.

After patching, monitor unusual activity and hosting alerts. If you find unauthorized files, unexpected administrator accounts, malicious redirects or other indicators, follow a separate compromise-investigation process. Our guide to checking whether WordPress has been hackedexplains the difference between a vulnerability and evidence of a real incident.

The takeaway

Patch the PHP runtime, not just the application. This is a server-level security update with consequences for WordPress, WooCommerce and every other PHP application. Verify the fixed release or vendor backport for each active PHP branch, then test your important workflows. Do not assume that a security plugin or WAF makes an unpatched PHP installation safe.

Frequently asked questions