What remote code execution means for your WordPress website
Two critical bugs fixed on October 21, 2026 can let a stranger run code on the computer your WordPress site lives on. Here it is in plain English.
"Unauthenticated remote code execution" means a stranger on the internet could make the computer your website lives on run their own instructions, without logging in. The people who make PHP, the software WordPress runs on behind the scenes, say two bugs they fixed on October 21, 2026 can allow exactly that. The fix has to be installed by the company you pay to keep your website online, so the most useful thing you can do today is ask them whether it's in.
What do PHP, server and host mean?
Every notice about these bugs leans on the same three words:
| Word | What it means |
|---|---|
| PHP | The software WordPress runs on, behind the scenes |
| Server | The computer your website lives on |
| Host, or hosting company | The company you pay to keep your website online: GoDaddy, Bluehost, SiteGround and so on |
If your hosting company manages PHP for you, Wordfence, a WordPress security company, says to contact them or check their status page. If you manage your own server, the update is yours to install (Wordfence).
The bugs are in PHP, not in WordPress. WordPress.org says "No WordPress update is required or planned for these issues" (WordPress.org, October 21, 2026). A website with every plugin and theme up to date can still need this fix.
What does "unauthenticated remote code execution" mean?
PHP's announcement says the new versions "fix two critical vulnerabilities that can allow unauthenticated remote code execution" (php.net). Taken one piece at a time:
| Piece | In plain English |
|---|---|
| Unauthenticated | No login. They don't need your WordPress password or anyone else's. |
| Remote | From anywhere with an internet connection |
| Code execution | They can make your server run instructions they wrote |
CISA, the US government's cybersecurity agency, says the bugs "affect all PHP installations serving web requests," and that updating to the fixed versions fixes them (CISA, October 21, 2026). Researchers have shown the attack working against WordPress, Drupal and Joomla websites (Huntress, citing Wiz research).
What does the NSA mean by "take control of affected web servers"?
On October 21, the NSA advised organizations to prioritize the patches for these bugs. It said they "could allow attackers to take control of affected web servers without prior access or authentication" (NSA, "NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities," October 21, 2026). In plain words: someone could take over the computer your website lives on without logging in. That computer holds your whole WordPress website, in two places.
| Part of the server | What it holds on a shop's WordPress website |
|---|---|
| File system | The files the website is built from: WordPress, your theme, your plugins, and the photos and PDFs you've uploaded |
| Database | Your pages, the logins for everyone who can sign in to WordPress, and form submissions |
Picture the service request form on a heating and air or plumbing website. A customer types a name, a phone number, a street address, and what's wrong. If your form keeps a copy of each entry on the website, those entries sit in the database. The logins cover you, your office manager, and anyone else you've given access to, such as a web company.
How serious are the CVSS 3.1 and CVSS 4.0 scores?
Security bugs get a severity score from 0 to 10 under CVSS, the Common Vulnerability Scoring System. FIRST, the organization that publishes CVSS, sorts the scores into these bands (FIRST, CVSS 3.1; FIRST, CVSS 4.0):
| Rating | Score |
|---|---|
| None | 0.0 |
| Low | 0.1-3.9 |
| Medium | 4.0-6.9 |
| High | 7.0-8.9 |
| Critical | 9.0-10.0 |
NIST's National Vulnerability Database rates both bugs 9.8 out of 10 on the CVSS 3.1 scale (NVD: CVE-2026-109618, CVE-2026-109619). The PHP project rates both 9.2 on the newer CVSS 4.0 scale (php.net). Both scores sit in the Critical band, and the gap between them comes from the two versions of the scale. As of October 21, 2026, both NVD records were marked "Modified," so the scores could still change.
Those two codes, CVE-2026-109618 and CVE-2026-109619, are the official ID numbers for the bugs. Put them in any message to your host so there's no doubt about which fix you mean.
Is anyone using these bugs yet?
Reports differ, so here are both sides. As of October 21, Cloudflare, which runs a firewall service (a filter in front of websites that blocks bad traffic), says it has seen attack traffic aimed at these bugs (Cloudflare). CISA said in its October 21 alert that it "has not observed exploitation of these vulnerabilities as of the time of publication" (CISA). As of October 21, neither bug was on CISA's list of known exploited vulnerabilities (CISA catalog).
Both statements can be true at once. Cloudflare is describing its own network, and CISA its view on the day it published. We post changes on our WordPress advisory page.
What can you do today?
-
Find your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open Server (WordPress.org). Write down the whole number, such as 8.3.36.
-
Ask your host, in writing, whether the fix is installed. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (php.net). Some hosts install the fix without changing the number your website shows, which is why their written answer counts for more than the number (Wordfence).
-
Pass on any plugin or pasted code that claims to fix this. Patchstack, another WordPress security company, advises avoiding unofficial "fix" plugins and copy-pasted snippets (Patchstack).
The message to send your host is on our WordPress advisory page, ready to copy.
Where does The Graphite Lab fit in?
The websites we build don't run PHP or WordPress, so these two bugs have nothing to attach to. There are no plugins to keep updated and no WordPress login page for anyone to guess passwords on. We build websites for trades businesses, and the first draft of a new site is ready for your review within 10 business days of payment. If you'd like to talk it over, book a call.