WP Cloud-Powered Sites Protected Against Critical PHP Vulnerabilities

The PHP project has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated remote code execution. See the PHP security advisory for details.

WP Cloud-powered sites are already protected against both vulnerabilities. Automattic worked closely with the PHP Security team to ensure that all sites hosted on the WP Cloud platform were protected as soon as possible. For sites hosted on WP Cloud, client hosts, their end customers, and site users do not need to take action.

If you manage PHP installations outside WP Cloud, follow the PHP project’s update guidance for those systems immediately. For more, including recommendations for those not on Automattic’s infrastructure, additional information is available on Automattic’s blog.