Two critical PHP flaws were patched on 21 October. Updating WordPress doesn't fix them.
On 21 October 2026 the PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The releases fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. In the PHP team’s words, they “can allow unauthenticated remote code execution”: an attacker could run code on your server without logging in. WordPress runs on PHP, […]