How to read a PHP security advisory: CVE, GHSA, CVSS and patched versions
Short answer
A PHP security advisory answers five questions, and you only need to find them. What is affected: the CVE number and a one-line description. How bad: the CVSS score (9.0 to 10.0 is critical). Who: which setups, here every PHP that serves web pages. Which versions are fixed: the patched releases, like 8.3.36. What to do until you update: the mitigations, which are partial. For a WordPress site, the decisive line is the patched version: compare it with Tools → Site Health → Info → Server → PHP version, and if yours is lower, ask your host to update.
The parts of an advisory
Using the October 2026 PHP advisory as the example (php.net):
| Part | Example | What it tells you |
|---|---|---|
| CVE | CVE-2026-109618 | The public ID; use it to search for news and your host’s statements |
| GHSA | GHSA-w8hw-w9fx-j79w | The GitHub advisory with the technical details |
| Title | RCE via OOM corruption | What kind of flaw: RCE means remote code execution |
| Severity | Critical, CVSS v4 9.2 | How serious, on a scale of 0 to 10 |
| Who is at risk | All PHP serving web requests | Whether your setup is concerned |
| Patched versions | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | The versions to be on |
| Mitigations | memory_limit, session settings | Stopgaps until you update |
The CVSS score
CVSS is a common way to score how serious a vulnerability is. Its specification maps scores to words: 0.1 to 3.9 is low, 4.0 to 6.9 medium, 7.0 to 8.9 high, and 9.0 to 10.0 critical (FIRST, CVSS v4.0). Both October 2026 PHP flaws scored 9.2 in their GitHub advisories (GHSA-w8hw-w9fx-j79w).
Who is at risk
This part tells you whether your setup is concerned. php.net: “Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.” (php.net) For a WordPress site, that’s yes. The setup names are SAPIs; Site Health shows yours (which one you use).
The patched versions
The most useful line for a site owner. Compare it with the full number in Tools → Site Health → Info → Server (how): the third part decides. If your branch isn’t listed at all, as 8.1 and older weren’t in October 2026, your version gets no official fix (what that means).
The mitigations
Advisories often list settings that reduce the risk until you can update. Read them as php.net presents them: “while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.” (php.net) They are for whoever manages the server: the October 2026 mitigations explained.
Then act
- Compare the patched versions with Site Health.
- Ask your host if you’re below them (what to ask).
- Plan an upgrade if your branch has no fix (how).
The October 2026 advisory in plain words: CVE-2026-109618 and CVE-2026-109619 explained.
Key takeaways
- CVE: the public ID of a vulnerability, like CVE-2026-109618.
- GHSA: the GitHub Security Advisory ID, where PHP publishes the technical details.
- CVSS: a severity score from 0 to 10; 9.0 to 10.0 is rated critical.
- Patched versions are the line that matters most: compare it with Site Health.
- Mitigations are stopgaps, not fixes; php.net says so itself.
Frequently asked questions
Where does PHP publish its security advisories?
On php.net’s news pages, and in full detail as GitHub Security Advisories of the php-src repository, linked from the news item.
What does “unauthenticated” mean in an advisory?
That the attacker doesn’t need an account or a login on the site to exploit the flaw.
Does a high CVSS score mean my site was attacked?
No. It rates how serious the flaw is, not whether anyone used it against you. Reports of attacks in the wild come from security firms, separately.
Check your own site before you upgrade
CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.
Sources
- php.net: Security advisory, 21 October 2026
- FIRST: CVSS v4.0 specification
- GitHub: GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.