The PHP project has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated remote code execution. See the PHP security advisory for details.

Pressable sites are already protected against both vulnerabilities. Our parent company, Automattic, worked closely with the PHP Security team to protect these sites as soon as possible.

• Every PHP version available on Pressable is protected.
• All Pressable sites are covered, including Sandbox, Staging, and Production sites.
• Pressable customers do not need to take action.

If you manage PHP installations outside of Pressable, follow the PHP project’s update guidance for those systems immediately. No action is necessary for sites powered by Pressable.