PHP ships an emergency fix for two critical code-execution bugs

PHP pushed out patches early for two critical flaws that can let attackers run code on a huge chunk of the web. Exploits are already floating around, and older PHP versions aren't getting the fix, so upgrade now.

This is the one to drop everything for. The bugs (CVE-2026-109618 and CVE-2026-109619) live in PHP core, so it’s not about one plugin or CMS. WordPress, Drupal, Magento, whatever sits on top can be in the blast radius depending on setup.

The catch: only supported PHP branches got patched. If your host is still running some ancient PHP, this is your sign to move.

Check your PHP version (php -v) and update to the latest patch on your branch.
On shared hosting? Ping your host and confirm they’ve rolled it out.
Can’t patch yet? Take it offline or put it behind a WAF until you can.