Background
On 21 October 2026 the PHP project released emergency fixes for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Details became public before the fixes, so patching is urgent. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older will not get an official fix.
Whether your site is protected depends on your hosting provider. This plugin shows you the answer right in the WordPress admin. Sources: the CERT-EU advisory and the PHP announcement.
What you will see
One notice for administrators, shown on every admin page. The wording is the same as in the plugin.
Patched
PHP 8.3.36 is patched. Your server is protected against CVE-2026-109618 and CVE-2026-109619.
Uninstall pluginStatus unclear
PHP 8.3.6: status cannot be determined reliably. This PHP version most likely comes from the package manager of your server (e.g. Debian, Ubuntu or RHEL). Such packages are often patched without changing the version number, so your server may already be protected. Please ask your hosting provider whether the security updates of 21 October 2026 have been applied.
Not patched
PHP 8.3.35 is NOT patched. Your hosting provider has not yet closed the vulnerabilities. Please contact your hosting provider or switch the PHP version.
Patched PHP versions
| PHP branch | Patched from | Notes |
|---|---|---|
8.5 | 8.5.12 | Newer branches count as patched. |
8.4 | 8.4.27 | |
8.3 | 8.3.36 | |
8.2 | 8.2.35 | |
8.1 and older | none | End of life, no official fix. Shown as not patched. |
Installation
- Download the ZIP file.
- In WordPress go to Plugins → Add New Plugin → Upload Plugin, choose the ZIP and install it.
- Activate the plugin. The notice appears right away.
Once the notice is green, the Uninstall plugin button removes the plugin completely: it deactivates and deletes itself.
Good to know
- Hosting packages Debian, Ubuntu, RHEL and similar systems often patch without changing the version number. For these the plugin shows the yellow notice instead of a red one. A host that compiles PHP itself without a recognisable package marker can still show red even though it is patched; your host can confirm.
- Languages English by default, German (
de_DE) when the administrator’s language is German. Translations are standard.po/.mofiles, a.pottemplate is included. - Lightweight A single PHP file, no settings page, no database entries and no external requests.