CVE-2026-109618 and CVE-2026-109619 explained for WordPress users

The two flaws, in php.net’s words

From the security advisory of 21 October 2026 (php.net):

• CVE-2026-109618, RCE via OOM corruption: “out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.”
• CVE-2026-109619, RCE via stale global state: “request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.”

Both GitHub advisories rate them critical, 9.2 on the CVSS v4 scale (CVE-2026-109618, CVE-2026-109619).

In plain words

PHP handles each visit to your site as a request, often in a long-running worker process that serves many requests one after another.

• The first flaw concerns what happens when PHP hits its memory limit in the middle of setting up a request. It stops abruptly, and the clean-up that follows can work on data that was never properly filled in. An attacker who can make that happen on purpose, with carefully shaped requests, can turn it into running their own code.
• The second flaw concerns leftovers: a piece of state from one request that should have been cleared stays behind, pointing to memory that has already been released. The next request on the same worker can use it before PHP resets it.

Neither needs a login, and neither depends on WordPress’s code.

Who is most at risk

php.net: “Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.” (php.net)

How to see which one your host uses: mod_php or PHP-FPM?

What it means for a WordPress site

• The fix is a PHP update on the server. No WordPress release, plugin or theme update fixes it.
• Your plugins aren’t affected by the patch: it keeps the same PHP series (why).
• Sites on PHP 8.1 or older have no official fix, and need to move up: how to upgrade safely.

What to do, step by step: PHP2Shell: what WordPress site owners should do now. How to read advisories like these yourself: how to read a PHP security advisory.