The PHP security team has released emergency fixes for two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619). Both can let an attacker run code on a web server without logging in. Details of the flaws leaked a day before the fix was ready, so attackers may already know how to target unpatched servers. WordPress runs on PHP, so any WordPress site on an unpatched PHP version could be exposed.
Note: Please note these issues are not specific to WordPress, and no WordPress or Kirki update is required. The fix is a PHP update on your server.
Which PHP versions are fixed?
The patched releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
If you’re on PHP 8.1 or older, your version no longer receives regular security updates, so you’ll need to upgrade to one of the versions above.
Keep in mind that updating WordPress core, your theme, or your plugins doesn’t change your PHP version. PHP runs on your hosting server, so the update happens in your hosting account or through your hosting provider. A security plugin can’t block these flaws either.
What to do right now
- Check your PHP version. In your WordPress dashboard, go to Tools > Site Health, open the Info tab, and expand the Server section.
- Back up your site (files and database) before making any changes.
- Update to a patched version. Most hosting dashboards let you switch PHP versions yourself. If you can’t find the setting, ask your host to move you to a patched release. If you manage your own server, update PHP and restart your web server or PHP-FPM so the new version takes effect.
- Test your site. Before switching, check that your theme and plugins support the PHP version you’re moving to. If you’re unsure, try it on a staging copy first. After the switch, check your key pages, forms, checkout, and any plugins you rely on.
- Check for signs of a break-in. Updating PHP stops new attacks, but it won’t remove an attacker who is already in. Look for administrator accounts you don’t recognize (Users > All Users) and for PHP files that were added or changed unexpectedly, especially in the uploads folder.
If you can’t update right away
Many managed hosts, including WordPress.com have already applied the fix, but rollouts are still in progress elsewhere, so contact your host and confirm that PHP has been updated on your account.
If you manage your own server and you’re on an unsupported PHP version, consider taking your site offline while you prepare the upgrade.
A note for Kirki users
WordPress or Kirki don’t require an update for this issue, because the fix is at the server level. As always, keep WordPress core, your templates, and your plugins up to date alongside PHP.
