What it is about
Both vulnerabilities sit in PHP itself, one level below WordPress and its plugins. The PHP project describes them like this:
- CVE-2026-109618: when PHP runs out of memory during a request, it can be interrupted while internal request data is only partly set up. The cleanup that follows may then treat that data as valid.
- CVE-2026-109619: internal data of a request can survive after its memory has been freed. A later request handled by the same process may then use it.
In both cases the confirmed impact is that an attacker without a login can run their own code with the rights of the web server. Both are rated 9.2 out of 10 (CVSS 4.0). Reports call them "PHP2Shell", after the 2021 Log4j vulnerability "Log4Shell".
So they are closed on the server, with a new PHP release, however current WordPress and its plugins are.
Who is affected
According to the PHP project, every PHP installation that answers requests from the web is affected, whichever way it runs. It rates the risk highest for Apache with mod_php, where it has shown an attack that works before any code of the website runs. The BSI considers every known version back to at least PHP 5 vulnerable.
These releases are patched, all published on 21 October 2026:
| Branch | Patched from |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
PHP 8.1 and older no longer get updates from the PHP project. Given the severity, it still published small source patches for 7.4, 8.0 and 8.1, and some Linux distributions and long-term support vendors ship the fix for their packages.
How to find out which version runs
In WordPress it is in the admin area under Tools → Site Health, on the Info tab in the Server section. On rented web hosting, the host's customer panel shows it too, usually with the PHP settings.
If you see a lower number than in the table, the site may still be patched. Linux distributions and hosts received the fixes in advance, and whoever builds them into their existing release often keeps the old number. Your host can then tell you for certain.
What to do
On rented web hosting, your host installs the update. The customer panel usually only lets you choose between the releases it offers. If a patched one is among them, switch to it. If not, ask your host whether your release contains the fixes for CVE-2026-109618 and CVE-2026-109619. With those two numbers you get a precise answer.
On your own server, update today, through your distribution's packages or to one of the releases in the table. Then check that every PHP process has restarted, or the old release keeps running.
With a site builder such as Wix, Jimdo, Squarespace or Shopify, the provider runs the server, and the update is its job.
If an agency looks after your site, send it this page. The numbers in the table are enough of a brief.
The PHP project also lists settings that block individual attack paths, and says itself that only the update makes an installation safe. On shared hosting, the host sets most of them anyway.
Why it is urgent
The BSI expects the vulnerabilities to be exploited on a large scale "within a few hours" of the updates appearing (our translation). Attackers can use AI tools to analyse the updates quickly and build attacks from them, says BSI vice president Thomas Caspers, adding: "Action is therefore needed without delay!"
Automated scanners do not ask how big a business is. A taken-over site costs twice: the site itself, and its standing with Google, which flags such sites with a warning or removes them from its results.