How to Update Your WordPress PHP to Fix Critical Vulnerabilities

Yesterday, the PHP security team announced the new updates for PHP 8.1, 8.2, 8.3, 8.4, and 8.5 versions that address two critical RCE (Remote Code Execution) vulnerabilities, named PHP2Shell, inside the current PHP versions, the CVE-2026-109618 and CVE-2026-109619. These CVEs are rated as Critical with a CVSS score of 9.2. All PHP installations are advised to update or upgrade, including those running PHP older than 8.2.

If you’re using a managed hosting or some kind of a control panel, contact your service provider or check your panel for these latest versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

In case your version is PHP 8.1 or older, you should upgrade to 8.2 or newer and get the latest update.

If you can SSH to your server, then it is more controllable. First, check your current PHP version:

php -vCode language: Shell Session (shell)

If your version is older, enter these commands to update your PHP:

sudo apt update
sudo apt upgrade
Code language: Shell Session (shell)

If your current repo doesn’t have the latest version, try using the Ondrej’s repo. Ondrej (Ondřej Surý) is a Debian developer who has been packaging PHP for Debian since PHP 5. He the one who build and maintain the official PHP packages in Debian and Ubuntu for more than two decades. So it’s safe to use his repo to get the latest PHP packages.

Enter these commands in your terminal:

# Add `ondrej/php` repo to your system package manager.
sudo add-apt-repository ppa:ondrej/php
sudo apt update

# Another Ondrej's repo, he plans to merge the old repo to this one later.
curl -fsSL https://packages.sury.org/php/README.txt | sudo bash

# Update package list
sudo apt updateCode language: Bash (bash)

These two repos contain his latest PHP packages. After adding them, anytime you enter sudo apt update, the system will find the latest packages from both sources for you to update.

Now you can run sudo apt upgrade to update your PHP version, and run php -v to confirm it has been updated.

Bonus: How to Track Ondrej Packages

When there are new PHP versions, it takes time for Ondrej to build, package and publish on those repos. To keep track of the progress (of the ppa:ondrej/php repo), visit this web page (use the filter to search for your PHP version).

The new repo, packages.sury.org, currently doesn’t have any page to keep track of. But if you’ve already added it to your system package list, you can enter this command to know what the latest version is:

sudo apt update
apt-cache policy php8.4-cliCode language: Bash (bash)

Change the version number in php8.4-cli to your correct version. If you’re using PHP 8.5, then the command would be:

apt-cache policy php8.5-cliCode language: Bash (bash)

It will output your current PHP version, the latest PHP version as well as which repo they’re coming from:

php8.4-cli:
  Installed: 8.4.27-1+ubuntu24.04.1+deb.sury.org+1
  Candidate: 8.4.27-1+ubuntu24.04.1+deb.sury.org+1
  Version table:
 *** 8.4.27-1+ubuntu24.04.1+deb.sury.org+1 500
        500 https://ppa.launchpadcontent.net/ondrej/php/ubuntu noble/main arm64 Packages
        100 /var/lib/dpkg/status
     8.4.26-1+0~20260925.56+ubuntu24.04~1.gbp80d95d 500
        500 https://packages.sury.org/php noble/main arm64 PackagesCode language: plaintext (plaintext)

• The Installed: ... line indicates your current PHP version.
• The Candidate: ... line indicates the version that you will get when you run sudo apt upgrade.
• The Version table: section lists all your system repos and their latest PHP packages.

Stay updated, stay secured!