A website can show the latest WordPress version while its PHP runtime still needs an update. Check the layer that received the security fix.
What PHP fixed on October 21
The PHP project’s security advisory identifies two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The maintainers say they can allow unauthenticated remote code execution.
Upstream fixes are available in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The project urges users serving web requests to update. It identifies mod_php as the highest demonstrated risk.
WordPress’s separate notice confirms that the issues concern PHP itself. Waiting for a WordPress core release does not address them.
Keep the AI discovery story properly attributed
OpenAI’s disclosure account describes a coalition supporting the response. It credits Calif’s work with GPT-5.6 Sol and independent discoveries by Wiz. PHP maintainers led the fixes and release.
That account explains the reported role of AI-assisted research. The maintainer advisory establishes the affected runtime and available fixes. Neither account establishes the patch state of a particular website.
Inventory the runtime that serves requests
On WordPress, the project points owners to Tools, Site Health, Info, Server for the PHP version. Your hosting control panel can provide another view.
A command-line version can belong to a different PHP installation. Ask the host which runtime and package serve each domain, including background workers or separate application pools.
- Record the domain and its active web runtime.
- Confirm the patched package or applicable vendor backport.
- Follow the provider’s update and restart instructions.
- Recheck the version used by actual web requests.
- Verify the application’s important public and authenticated flows.
These are proposed verification steps. We have not audited the runtime or patch state of readers’ sites.
Treat mitigations as temporary exposure reduction
PHP says configuration mitigations do not provide a complete solution. Follow the current maintainer and hosting-provider guidance while arranging the update.
Distributions can backport fixes without adopting the upstream version string. Obtain the vendor’s package evidence before deciding that a lower-looking number is unpatched.
I would retain the host’s confirmation with the post-update application checks. That provides a clearer completion record than a screenshot of an unrelated CMS update.
Our app-security checklist covers generated findings and verification. The GitHub AI Scan guide explains the limits of another AI-assisted scanner.
Read the sources and choose your next check
- PHP advisory, affected configurations and fixed releases
- WordPress guidance on the PHP update
- OpenAI’s account of the coordinated discovery and response
What evidence does your host provide that the runtime serving your domain has been patched?
Checked October 22, 2026. This article is based on source review and analysis. Suggested tests have not been performed by MustHave.ai.
