On October 21, 2026, the PHP project disclosed two critical vulnerabilities that can allow unauthenticated remote code execution on affected web servers. Both vulnerabilities received a CVSS v4.0 score of 9.2.
Pagely deployed initial mitigations while preparing updated PHP containers, then completed the rollout of the full security fixes across customer servers. No further action is required from Pagely customers for this PHP update.
The patched PHP releases are:
What was disclosed?
Both vulnerabilities affect PHP itself rather than WordPress core, a plugin, or a theme.
CVE-2026-109618 involves PHP’s handling of out-of-memory conditions. Request processing can be interrupted while internal data is only partially initialized, after which PHP may treat that incomplete data as valid during cleanup. The resulting memory corruption can create a path to remote code execution.
CVE-2026-109619 involves stale internal state. A PHP worker can retain a reference to request data after the underlying memory has been released. A later request handled by the same worker may access that stale information before normal initialization resets it, potentially leading to information disclosure or remote code execution.
Because the vulnerabilities exist in the PHP runtime, updating WordPress or its extensions would not resolve them. The PHP software serving the application needed to be updated.
Why the response required immediate action
Reports of PHP2Shell exploitation attempts were already emerging around the release of the official fixes. Hadrian reported, “We are now seeing php2shell exploited in the wild at scale,” with much of the observed activity targeting PHP’s session upload-progress functionality. Other security organizations also reported exploit traffic, although attempts did not necessarily indicate successful compromise.
That activity made the window between disclosure and remediation especially important. Temporary controls could reduce exposure while the updated PHP builds were prepared, but the complete resolution required deploying the patched runtime.
How Pagely responded
We actively tracked the issue publicly through the Pagely status page and moved from investigation to mitigation and full deployment over the course of October 21:
- 14:14 UTC: We acknowledged the PHP advisory, began investigating, and confirmed that customers would not need to perform the PHP upgrade themselves.
- 14:34 UTC: Initial mitigations had been deployed while the team built updated PHP containers containing the complete fixes.
- 18:51 UTC: We completed deployment of the PHP security updates across customer servers and marked the advisory resolved.
This progression matters. Initial mitigations helped reduce immediate exposure, while the rebuilt PHP containers addressed the underlying vulnerabilities.
What Pagely customers need to do
No customer action is required for the PHP security update covered by this advisory. Pagely completed the server-level deployment across customer environments.
Customers do not need to manually install PHP packages, rebuild containers, or restart PHP workers for these fixes. We handled that work as part of our managed hosting platform.
WordPress core, plugins, and themes should continue to be kept current, but those updates are separate from the PHP runtime fixes described here.
Managed hosting when the runtime itself is affected
Critical vulnerabilities in foundational software create a different operational challenge than a typical WordPress plugin update. Responding can require teams to:
- Monitor an evolving vendor disclosure.
- Evaluate and deploy temporary mitigations.
- Build and test updated runtime containers.
- Coordinate deployment across production infrastructure.
- Verify that patched versions are active.
For teams running high-stakes WordPress sites, those responsibilities can compete with application development, publishing, and other business priorities. Pagely manages the underlying hosting environment so customers are not left coordinating an emergency runtime rollout on their own.
That does not eliminate every security risk. It does mean that when a critical issue affects the infrastructure beneath WordPress, there is an experienced team responsible for evaluating the disclosure, implementing the required changes, and communicating the status of the response.
Current status
We have completed deployment of the PHP security updates across customer servers, and no further customer action is required for this update. Customers can follow current and historical operational notices through the Pagely status page.
PHP’s upstream advisories credit lcfr-hax, sagitzadik-wiz, tomash-areion, and amyb-oai with reporting the vulnerabilities. Additional technical information is available in the official PHP security advisory, the PHP changelog, and the two GitHub security advisories.
