On 22 October 2026, New Zealand’s NCSC warned that CVE-2026-109618 and CVE-2026-109619 could allow unauthenticated remote code execution on affected PHP servers. NCSC reported awareness of active exploitation reports. This does not establish that every PHP website has been compromised.

WordPress runs on PHP. WordPress.org’s notice, dated 21 October, confirms that these issues are not specific to WordPress and will not be resolved through a dedicated WordPress update. Owners need to check the hosting environment, not just plugins, themes or dashboard updates.

GoDaddy provides a practical example: at 08:30 on 22 October, New Zealand time, it announced completed PHP fixes for Managed Hosting for WordPress. Self-managed VPS customers remained responsible for server updates. Customers of other providers should obtain separate confirmation.

PHP released fixes for the original two vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some providers supply backported fixes without changing the displayed version, so ask for confirmation of the relevant patch or package build rather than relying on the version alone.

A separate PHP advisory dated 23 October describes CVE-2026-115560, an additional risk requiring an unusual combination of configuration and application behaviour. Technical teams should check the follow-up guidance on session upload progress. Installing the first patches should not be described as eliminating every related risk.

For businesses relying on websites for orders, bookings or customer information, retain written remediation confirmation and completion dates, and test essential functions. If suspicious access or data exposure is identified, preserve logs and activate incident response. This article was checked on 26 October 2026; source-page dates without a stated timezone are retained as published.

Source: NCSC NZ · WordPress.org · PHP · GoDaddy · Checked: 26 October 2026

Read the official source

WordPress.org · PHP · GoDaddy

A short editorial summary of the linked source, with general commentary. Check the official source for subsequent updates.