Critical PHP Vulnerabilities: Rocket.net’s Response 

On October 21, 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, these flaws could allow an attacker to run code on a server without authentication. 

They affect PHP itself, the language WordPress runs on, making this an important security update for anyone running a WordPress website. Read the official advisory. 

What we’ve done 

All currently supported PHP versions across the Rocket.net platform have been patched to address both vulnerabilities. We’ve handled these server updates; you don’t need to install the PHP patches yourself. 

Our team has been on this since the first information became available. We applied mitigations and deployed patches as updated packages were released, coordinating updates across PHP versions and vendor release schedules while monitoring stability. 

Sites hosted on Rocket.net also benefit from Cloudflare Enterprise’s firewall protections. Cloudflare has deployed protections targeting these vulnerabilities, adding another layer of defense. That helps reduce exposure, but it doesn’t replace PHP patching. Read Cloudflare’s explanation. 

Why your PHP version number may look unchanged 

If you check your PHP version using php -v or WordPress Site Health, you may still see the previous version number. Our server operating system vendor backported the security fixes into existing PHP builds without changing the base version string. The supported PHP versions covered by this rollout are patched even if the displayed version number hasn’t changed. 

Keeping PHP current 

If your site runs an older, unsupported version of PHP, we recommend moving to a supported version as soon as compatibility allows. Keeping PHP current helps ensure your site receives security fixes as they become available. 

We understand that older plugins or custom code can make upgrades more involved, and our support team can help you plan the next steps and check compatibility. 

What happens next 

We’ll continue monitoring the platform and investigating any issues customers report. We’ll post further updates on our status page. 

If you have questions or notice unexpected behavior on your site, please contact our support team. We’ll work through it with you.