Two critical flaws in PHP were published on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619). They affect any server that runs PHP for websites, including every WordPress site. The flaws are in PHP itself, not in WordPress or in BDAW products. bdaw.com is updated.
Check your site
- In WordPress, open Tools → Site Health → Info.
- Open Server and read PHP version.
- Compare it with the table.
| PHP | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
A lower number does not always mean the site is exposed: hosts and Linux distributions often apply the fix without changing the version number. If your number is lower, ask your host to confirm the October 2026 PHP security fixes are installed.
Fix it
- Hosting panel: in the PHP settings, choose a fixed version, or the newest one offered.
- Managed hosting: ask your host to confirm the update.
- Your own server: install your distribution’s updated PHP packages, then restart PHP and the web server.
PHP 8.1 and older no longer receive regular fixes. BDAW products require PHP 8.2 or newer.
After the update
Open Site Health again and confirm the new version. BDAW products need no change.
Was this helpful?
Related
- Connect a WordPress site with BDAW WP Suite
- Update, hold, or go back to an earlier version
- Stable, testing and dev — which channel to use
- Check a download against its SHA-256
Need help? Open a support ticket.