The disclosure of critical PHP vulnerabilities required a swift response from those running production websites and applications. At WordPane Cloud, we applied the fixes across all customer servers in our solutions from the first day they became available. We also addressed the additional advisory published on October 23.
What happened with PHP
On October 21, 2026, the PHP project published fixes for CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution in affected environments.
The advisory covers installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project identifies mod_php as the highest demonstrated risk. The review therefore needs to consider the PHP installation used by the server, as well as the installed CMS.
WordPane Cloud’s response
From day one, we brought the fixes to customer servers in WordPane Cloud solutions. Our response also covered the additional October 23 advisory, identified as CVE-2026-115560.
This work takes place in the layer that runs applications. Updating WordPress, a plugin or a theme is a different task from fixing the server’s PHP installation. Maintaining a website involves both layers.
For people maintaining a store, a portal or several client websites, this response reduces the need to track every technical advisory to request infrastructure remediation from our team.
The October 21 fixes and the additional advisory
The October 21 advisory lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as releases fixing the initial two flaws. Linux distributions may also deliver backported fixes while retaining the base version number. Verification should consider the vendor’s package.
The October 23 advisory concerns an uncommon combination of session configuration and application behaviour. It was not resolved by the October 21 updates. Until the next regular release, the PHP project recommends disabling session.upload_progress.enabled in the relevant environments and restarting workers. As of this article’s publication, that measure remains relevant to the additional advisory.
What still matters for your application
The PHP fix addresses the vulnerabilities disclosed in that layer. Maintaining application code and its components remains necessary.
- Keep your CMS, plugins, themes and dependencies up to date.
- Review administrator accounts and access permissions.
- Keep recovery copies and check that they can be restored.
- Investigate unexpected changes, new files or unusual errors.
Questions about your environment?
If you are a customer and need to confirm the response for a specific server, open a dashboard ticket and identify the environment you want us to check. Our team can guide verification according to its configuration.
This article records our response to the October 2026 incident. The references below let you follow the PHP project’s original advisories and any further updates.
Talk to our team about your server
Sign in to the dashboard to open a ticket and ask about your application environment.
Open a support ticketConsult panel documentation
