On 21 October 2026, the PHP project released a critical security update fixing two serious vulnerabilities, both rated 9.2 on the CVSS v4.0 scale. Because every WordPress website runs on PHP, this affects almost every site on the internet. Here is what happened, what we have done for websites hosted with CompuStack, and what you may need to do.
The short version
- php.net released fixes on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- A fix is available for every PHP version from 7.4 to 8.5. For 8.1 and older, it comes as source patches from the PHP security team rather than a new release.
- Websites hosted with CompuStack are already protected. Every PHP version on our hosting platform, from 7.4 to 8.5, has been patched. We host and manage your website, so there is nothing you need to do.
What happened
The PHP security team announced on 20 October that a security release was coming, and published it on 21 October, ahead of the planned time. It fixes two vulnerabilities that security researchers have nicknamed “PHP2Shell”:
- CVE-2026-109618: when PHP runs out of memory while handling a request, it can be interrupted part-way through setting up internal data and then treat that half-built data as valid during clean-up.
- CVE-2026-109619: internal data from one request can outlive the memory behind it, and a later request handled by the same PHP worker can pick up that stale data before it is reset.
Both are classed as critical remote code execution flaws. In plain terms, a successful attack could let someone run their own code on the web server. The PHP project says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Full technical details are in php.net’s security advisory.
Why it matters for WordPress
WordPress is written in PHP, so every WordPress site depends on the PHP version running underneath it. This isn’t a flaw in WordPress, a plugin or a theme, and it can’t be fixed by updating them. The fix has to be applied to PHP itself, on the server.
That is why your hosting matters. On a host that keeps PHP patched, the fix is applied for you. On a host that doesn’t, a site can stay exposed even if every plugin is up to date.
What we did for CompuStack-hosted websites
Public exploit code linked to these vulnerabilities began circulating on 21 October, and our hosting platform saw attempts to use it against WordPress sites. Here is how it was handled:
- Extra protection first. Before the official fix was released, additional protections were applied across the hosting platform, including the web application firewall (WAF), as a safety net.
- Attempts blocked. The firewall blocked every exploit attempt that was found, and we have found no sign that any got through. Automated scanners probing large numbers of sites for weaknesses were blocked too.
- Patched builds applied. Once the fix was released, it was applied to every PHP version on the platform during an emergency maintenance window. Sites on PHP 8.2 to 8.5 now run the fixed releases (8.2.35, 8.3.36, 8.4.27 and 8.5.12). Sites on PHP 7.4, 8.0 and 8.1 have the PHP security team’s source patches applied.
The firewall is a useful extra layer, but the PHP project has been clear that the real fix is patching PHP itself, and that is what has now been done.
How updates work on our hosting
Keeping a website secure means keeping the layers underneath it up to date as well as the plugins and themes you can see in your WordPress dashboard. For websites hosted with CompuStack:
- Server-level security fixes are applied for you. PHP patches like this one are rolled out across the hosting platform, so there is nothing to log in to, run or schedule.
- Protection comes before the patch where possible. When a serious vulnerability is announced, we add firewall protections as soon as we can, then apply the official fix as soon as it is available.
- Your PHP version is looked after for you. We manage the PHP version your site runs on, including upgrades and compatibility checks, so you never have to think about it.
What this means for you
Nothing. We host and manage your website, including the PHP version it runs on, so the patching, monitoring and any version changes are handled by our team. There is nothing for you to check, update or schedule.
Common questions
Is my website protected?
Yes. A patch is available for every PHP version we run, from 7.4 to 8.5, and it has been applied across our hosting platform. For the older versions that are end of life, the PHP security team published the fix as a source patch rather than a new release.
Will there be any downtime?
The patch has already been applied, during an emergency maintenance window on 21 October. There is nothing further for you to schedule.
Do I need to update WordPress, my plugins or my theme?
Not to fix this issue, as it sits in PHP rather than in WordPress or its add-ons.
Do I need to do anything?
No. We host and manage your website, including the PHP version it runs on, so there is nothing for you to do.
Timeline
All times are UTC.
- 20 October: The PHP security team announces an upcoming security release.
- 21 October, morning: Exploit attempts based on public proof-of-concept code begin appearing on our hosting platform. Additional firewall protections are applied and every attempt found is blocked.
- 21 October, 13:45: php.net publishes the fix and its security advisory, ahead of the planned 14:00 release.
- 21 October, afternoon: The fixed PHP builds are applied to every PHP version on the platform, from 7.4 to 8.5.
Need a hand?
If you have any questions about this update, or about how your website is hosted and protected, please contact the CompuStack team.
Sources: php.net security advisory, 21 October 2026 · PHP supported versions · GHSA-w8hw-w9fx-j79w · GHSA-6wmf-4rv5-p3rp