Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619
PHP announced a pending update to address critical security vulnerabilities on October 20th. These could allow remote code execution, leading to full compromise of a site running PHP, which is the language powering all WordPress sites. These are numbered as CVE-2026-109618 and CVE-2026-109619, and both have high CVSS, indicating critical problems in PHP.
Temporary Mitigations
Several hours after the initial announcement, our security vendor released updated webapp firewall rules to help block exploit of the vulnerabilities. These types of rules are not a complete solution, but they are intended to slow down attackers and block early exploit methods that may be publicly released. They will continue to be updated as security services see attacks against these CVE’s. The webapp firewall rules were automatically applied to our systems upon release.
They were reports early on that disabling PHP’s session.upload_progress.enabled option could help prevent one of the vulnerabilities from being exploited. We applied this early, which again is not a complete solution but is intended to delay any attacker’s ability to take advantage of these vulnerabilities. When PHP released its patches, they also specified some additional mitigations, which we have partially applied as we wait for patches to go live on our systems.
PHP Updates
As this post is being written, PHP updates are beginning to be applied to our systems. These will initially be rolled out for PHP 7.4+, and we expect it to be applied back to even earlier versions later today. If your sites are hosted at Lightning Base no action is required on your end to take advantage of this, the updates will be automatically applied to all sites. Once updates have rolled out PHP will be restarted, which is in most cases seamless, at most sites may see a brief moment or two where requests slow down or don’t go through.
Conclusion
I would like to thank the PHP team, the various security researchers looking into this, and our vendors for working on this problem. Based on what we have heard and seen exploit attempts against these vulnerabilities have been very limited prior to release of full updates, and with the mitigations we employed temporarily combined with the rollout of patches I expect our client sites should not be impacted by this severe security issue.
There has been a continuous stream of serious security problems across the entire software industry in recent months leading to urgent updates. This may continue for some time, and we will continue to work on keeping sites safe going forward.
