PHP has released emergency patches for two critical unauthenticated remote code execution vulnerabilities (CVE-2026-109618 & CVE-2026-109619). Attackers can take full control of websites — including WordPress, Drupal, and Joomla — before any application code even runs.
Affected versions: anything below 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
mod_php is considered the highest risk.
Updating WordPress or plugins alone will not fix this. You must update PHP itself.
Full details, impact analysis, and update commands for major Linux distros:
Please check and patch your servers immediately.