The PHP security team released fixes today for two critical vulnerabilities in PHP, the programming language that runs WordPress, Paid Memberships Pro, and most of the web. The team announced the release a day in advance, which they rarely do, and the PHP Foundation shared the same warning. Both vulnerabilities are rated Critical, and PHP says there is no complete workaround. Updating PHP is the fix.

If your membership site runs on WordPress, it runs on PHP. This post explains what the PHP vulnerability is, what we are doing for sites on PMPro Hosting, and what to ask your host if your site is hosted somewhere else.

What We Know About the PHP Security Release

On October 21, 2026, PHP published a security advisory along with new versions of every supported release:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Any version older than these on the same branch is affected. Here is what else the advisory says:

• Two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution, which means an attacker could run their own code on the server without logging in.
• Severity: Both are rated Critical, 9.2 out of 10 under CVSS v4.0, the standard scoring system for security issues.
• Who is affected: All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP considers the risk highest for mod_php.
• Workarounds: PHP lists partial workarounds but says “there are no complete mitigations, updating is the only safe choice.”

The PHP team first announced the release on October 20 in an advance notice, and the PHP Foundation shared it with the wider PHP community.

What If My Site Runs PHP 8.1 or Older?

PHP 8.1 and older no longer receive updates from the PHP project, so there is no official fixed release for them. Some Linux distributions and long-term support vendors provide their own patched versions. If your site runs PHP 8.1 or older, ask your host how they will protect it, and plan to upgrade to a supported version. Also note that PHP 8.2 reaches end of life on December 31, 2026.

If Your Site Is on PMPro Hosting

You do not need to do anything. As of 10:00 AM ET, every PMPro Hosting server is running the patched version of PHP, and our checks found no errors since the upgrade. Here is what our hosting team did:

1. Overnight, we turned off a PHP setting called session.upload_progress.enabled on every PMPro Hosting server, with no downtime. PHP’s advisory says this blocks the confirmed attack paths for one of the two vulnerabilities (CVE-2026-109619), though not every variant. The other vulnerability has no safe interim workaround, so the patch is the fix.
2. Ahead of the release, we moved every server to the same fast PHP package source and applied any pending server updates, so the whole fleet can be patched the same way.
3. As soon as PHP released the fix, we installed the patched PHP 8.3.36 from the official signed packages. We had rehearsed the full install on a staging server earlier in the morning, and kept our own verified build of the same version ready as a backup.
4. The rollout started with test sites, where we checked the PHP logs before moving on, then updated the rest of the servers in parallel batches. Every PMPro Hosting server had the update by about 10:00 AM ET, less than half an hour after PHP published it.
5. During the update, each site had a few seconds of downtime while PHP restarted.
6. New sites will also get the patch. We are updating the base image every new PMPro Hosting server is built from, so new sites launch with the fixed version of PHP.

If anything looks wrong on your site today, open a support ticket and our team will help.

If Your Site Is Hosted Somewhere Else

Most WordPress hosts manage PHP for you, which means your host is the one who installs the fix. Contact them today, even if you usually never think about PHP.

Questions to Ask Your Host Today

1. Have you updated my site to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35? If not, when will you?
2. If my site runs PHP 8.1 or older, how are you protecting it, and when can I move to a supported version?
3. Have you set session.upload_progress.enabled to Off as an extra precaution?
4. Will you tell me when my site has been updated?

A good host will have clear answers. If yours does not, that is useful information too. Our guide to the best web hosting for membership sites covers what to look for.

If You Manage Your Own Server

If you run your own VPS or server, you are responsible for the update:

1. Check which PHP version you are running with php -v (and check the version your web server actually uses, which can differ from the command line).
2. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 from your usual package source, then restart PHP-FPM or your web server. PHP says Linux distributions and long-term support vendors received the patches in advance, so check your vendor for updated packages. If you use the Remi repository, PHP notes it will not have updates today.
3. Until you can update, set session.upload_progress.enabled = 0 in your main php.ini and restart every PHP worker. PHP says not to rely on ini_set() or an FPM .user.ini file for this.
4. Read the official advisory for the other partial workarounds. They reduce risk, but PHP is clear that updating is the only safe choice.

How to Check Your PHP Version in WordPress

You do not need server access to see which version of PHP your site uses:

1. In your WordPress admin, go to Tools > Site Health.
2. Click the Info tab.
3. Open the Server section and look for PHP version.

If the version is lower than 8.5.12, 8.4.27, 8.3.36, or 8.2.35 on the same branch (for example, 8.3.35 instead of 8.3.36), your site still needs the update. Check again after your host says the update is done.

Update Log

We will add to this log as the situation changes. Newest updates are at the top.

• October 21, 2026, 10:01 AM ET: Final checks are complete. Every PMPro Hosting server is running the patched version of PHP, with no PHP errors since the upgrade. No action is needed.
• October 21, 2026, 10:00 AM ET: PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35, fixing CVE-2026-109618 and CVE-2026-109619, shortly before the scheduled 10:00 AM ET release. PMPro Hosting began rolling out the patch right away, starting with test sites.
• October 21, 2026, 9:15 AM ET: The PHP release is still scheduled for 10:00 AM ET. Security researchers expect attacks to start soon after details are published. Updating PHP is the fix, and interim settings alone are not enough. We are standing by to update PMPro Hosting servers as soon as a trusted build is available.
• October 21, 2026, 8:30 AM ET: Post published. The PHP release is scheduled for 10:00 AM ET. The interim setting is in place on all PMPro Hosting servers, and automated checks are watching for the release so we can start patching right away.
• October 21, 2026, overnight: session.upload_progress.enabled turned off on every PMPro Hosting server, with no downtime.
• October 20, 2026, evening: PHP announced the upcoming critical security release. Our hosting team began preparing servers for a fast update.

Frequently Asked Questions