On 21 October 2026, the PHP project released emergency patches for two critical vulnerabilities. WordPress websites, PrestaShop stores and other PHP-powered applications should check their actual runtime version and deploy the appropriate security release.
What happened?
CVE-2026-109618 and CVE-2026-109619 affect PHP's internal memory and request-state handling. Under certain conditions, they can enable unauthenticated remote code execution. These are PHP engine vulnerabilities, not vulnerabilities in a particular WordPress plugin or PrestaShop module. A web application firewall may limit some attack paths but cannot replace the patch.
Which PHP versions contain the fixes?
The patched versions released on 21 October 2026 are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. You do not need to change major branches merely to apply this fix: PHP 8.4.27 already includes it, while PHP 8.4.26 does not.
PHP 8.1 and older branches no longer receive upstream security updates, although some vendors may offer backported patches. PHP 8.2 reaches its security end of life on 31 December 2026; plan a supported-version migration.
How should you update PHP?
Check the runtime version through your hosting panel or application diagnostics. In WordPress, open Tools > Site Health > Info > Server. PrestaShop administrators can check their system information or hosting account.
Back up both files and databases before changing PHP branches. Verify compatibility with themes, plugins, modules and custom integrations, preferably in a staging environment. After the change, test public pages, admin areas, forms, email sending and error logs. If the patched PHP build is not available, ask your hosting provider when it will be deployed.
WordPress: update the CMS too
Updating WordPress does not fix these PHP vulnerabilities. Keeping the WordPress core, plugins and theme updated addresses separate application-level weaknesses. Review administrator accounts, remove unused extensions, retain reliable backups and check for suspicious changes.
If a site already shows unknown accounts, malicious redirects or spam pages, updates alone will not remove an existing compromise. Refer to our guide What to do if your WordPress site is hacked.
PrestaShop: test business-critical workflows
PrestaShop relies on PHP as well. Before switching PHP branches, confirm that your store version, theme and modules are compatible. Test product variants, cart, checkout, payments, carriers, inventory, transactional emails, scheduled jobs and ERP integrations. Some failures only appear during order validation.
Keep PrestaShop and installed modules up to date, but do not deploy a major upgrade to a live store without preparation and testing.
Maintenance matters beyond this incident
Apply urgent security patches promptly, schedule major version upgrades carefully, maintain verified backups, limit privileged access and monitor logs. At Concepty, we help businesses maintain, update and secure WordPress and PrestaShop sites.
Official sources: PHP, CERT-EU advisory, WordPress France advisory.
*Published on 23 October 2026. Version information is current as of this date.*