The PHP project published fixes on 21 October 2026 for bugs in request processing that could let an unauthenticated attacker corrupt memory and potentially execute code. The weaknesses are in PHP itself, not in a particular WordPress theme, plug-in or PHP application.
The first CVE concerns interrupted initialization during an out-of-memory condition. The second involves internal state that remains after its backing memory has been freed. The exact exploitability depends on the server interface, application path and environment; a demonstrated attack against one configuration does not prove an identical path elsewhere.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were the upstream fixed releases. Vendors may also supply backported fixes under different package identifiers. The separate CVE-2026-115560, announced two days later, has a narrower session-handler prerequisite and should not be treated as automatically fixed by those releases.
Inventory every web-serving PHP runtime, apply the relevant security update and restart its workers. Confirm the version or vendor patch, then review historical requests, crashes and suspicious process activity for signs of prior exploitation.