# Two critical PHP vulnerabilities: what WordPress site owners should know **URL:** \ **Category:** Announcements\ **Created:** [October 22, 2026, 5:54pm UTC](https://talk.wpcerber.com/t/two-critical-php-vulnerabilities-what-wordpress-site-owners-should-know/721 "2026-10-22T17:54:09Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![nick](https://talk.wpcerber.com/user_avatar/talk.wpcerber.com/nick/32/3_2.png) [@nick](https://talk.wpcerber.com/u/nick)\ **Post date:** [October 22, 2026, 5:54pm UTC](https://talk.wpcerber.com/t/two-critical-php-vulnerabilities-what-wordpress-site-owners-should-know/721/1 "2026-10-22T17:54:09Z")
On October 21, the PHP project released fixes for two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can potentially allow remote code execution under certain conditions. These vulnerabilities affect PHP itself, not WordPress. That distinction matters because updating WordPress, themes, or plugins won’t address the underlying problem. The fix must be applied to the PHP runtime on the server. **What should you do?** If you’re using shared or managed WordPress hosting, ask your provider to confirm that the PHP build serving your website has been patched against both vulnerabilities. If you use WP Cerber, go to **WP Cerber → Tools → Diagnostic → System Info** in your WordPress dashboard. There you’ll find your PHP version and Server API. Keep in mind that the version number alone may not tell the whole story, since hosting providers sometimes backport security fixes into older PHP builds. We’ve published a practical guide explaining which PHP versions are affected, how to check your patch status, and what to ask your hosting provider. **Read the article:** [Critical PHP Vulnerabilities: What WordPress Site Owners Need to Know](https://wpcerber.com/critical-php-vulnerabilities-what-wordpress-site-owners-need-to-know/) If you’re unsure whether your hosting environment has received the fixes, feel free to discuss it here.