PHP Vulnerability CVE-2026-109618: What to Do Now

Most website vulnerabilities live in a plugin or a theme, and the fix is to update that one component. These are different. They are in PHP's core, the part that handles every incoming web request before your site's own code even starts.

CVE-2026-109618 is a memory corruption bug in how PHP recovers when a request runs out of memory. An attacker can deliberately cause that condition and leave PHP cleaning up data it should not trust. The PHP project confirmed working remote code execution over plain HTTP against Apache with mod_php on default settings, and says PHP-FPM, FrankenPHP and LiteSpeed are likely susceptible too.

CVE-2026-109619 is a "stale state" bug. Information belonging to one request can survive after its memory is freed, and the next request handled by the same PHP worker can pick it up. The PHP project validated remote code execution against both Apache mod_php and PHP-FPM.

Both are rated critical, 9.2 out of 10, and neither requires an account, a password or any action by a user. According to AP, OpenAI led a coalition of researchers and security firms, including Wiz and Cloudflare, that worked with PHP's maintainers on the fixes over the previous two months. OpenAI says AI found the flaws before attackers did.

Most business owners don't know what their website runs on, and there's no reason they should. Here is the short version.

• WordPress, WooCommerce, Joomla, Drupal, Magento, or a Laravel app: these all run on PHP. Your server is affected until its PHP is updated to a fixed release.
• Shared or managed hosting (the kind with a cPanel login): your host controls the PHP version. Ask them which version your site is on right now and whether it has been patched.
• A site your old web designer or agency still hosts: you are relying on them to patch it. If you can't reach them today, that is its own answer.
• Wix, Squarespace or Shopify: you don't run a PHP server, so there's nothing for you to patch. That's the platform's job.
• A static site compiled ahead of time and served as files: there's no PHP running on request, so there's nothing to exploit here.

If you have a WordPress admin login, Tools → Site Health → Info → Server shows the PHP version your site is running. Compare it with the fixed releases below.

1. Update PHP to a fixed release: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Anything below those on the same branch is affected.
2. Restart PHP. PHP-FPM pools, Apache with mod_php, and any long-running workers keep running the old code until they restart. A package updated on disk doesn't protect a process that loaded the old one.
3. If you are on PHP 8.1 or older, a patch isn't coming. Those versions are past end of life. The fix is an upgrade to a supported branch, which on an old WordPress install can break plugins. Plan for that rather than discovering it.
4. If you can't update today, follow the FBI's advice: take the system offline until it can be fully mitigated. The PHP advisories list partial configuration workarounds for servers that can't update yet, and say plainly that updating is the only complete fix.
5. Watch for the signs. The FBI advises looking for PHP processes "unexpectedly launching command shells or downloading files." On a normal website, PHP has no reason to do either.

According to AP, some of these weaknesses had been sitting in PHP for more than a decade. Arctic Wolf's Ismael Valenzuela put it this way: "What changed wasn't the underlying code, but the ability to find those weaknesses and turn them into working exploits."

This time, the people who found the holes reported them first. That won't always be the case. The same tools that found these bugs are available to people who won't report what they find. As a result, the time between "a flaw exists" and "a flaw is being exploited" keeps getting shorter, and that's a problem for any business whose website depends on someone remembering to patch a server.

We made this argument in Your Website Has No Database to Hack and in The Hidden Costs of Plugin Dependencies. A website that runs code on every request has a permanent attack surface, and keeping it safe takes continuous attention. Today that surface turned out to include the language underneath the whole stack, not just the plugins on top of it.

The websites we build on Araptus Highlander don't run PHP, so this advisory didn't require anything of them. That isn't the same as being unhackable, and we won't claim it is.

Your domain and DNS are still targets, and so are the accounts with access to your hosting. Forms, bookings and payments still run on servers, and those servers need patching too. The difference is that they are small, separate services rather than one application that runs on every page view, so a flaw in one of them doesn't put the whole site and everything behind it in play.

What a static site removes is the specific risk in today's news: a flaw in the software that runs on every public request, which anyone on the internet can reach without logging in.