The WordPress PHP vulnerability going round this week is actually three separate remote-code-execution risks, reaching WordPress operators through three different components with three different owners and three different release channels. A "WordPress is updated" screenshot answers roughly a third of the question.

Layer Issue Affected Fixed in

PHP runtime CVE-2026-109618 and CVE-2026-109619 (php2shell) 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 PHP releases of 21 October

WordPress Core CVE-2026-119977 4.7.0 through 7.1.3 7.1.4, released 28 October, plus branch backports to 4.7.39

Plugin CVE-2026-120534 in ACF Extended PRO through 0.9.2.6 0.9.2.7 — but see below

Start with Core, because the clock is real

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue on 3 November, with a federal remediation deadline of 6 November .…