Remote code execution (RCE) means an attacker can make the computer that hosts your site run their own commands from afar. It is among the most serious flaws. Because code that runs on a server can do a lot, it is often counted as the most severe kind of flaw.
What is remote code execution?
With remote code execution the attacker does not need to sit at the machine. Code that runs on a server can do whatever the software running there can do: read files, change pages, send mail or reach the database.
Normally a server only runs code that its owner put there. An RCE flaw breaks that rule. Through a weakness in the software, input from outside gets treated as something to run, or the memory the program uses is pushed into a state where an attacker can steer what happens next. The attacker does not need physical access, only a way to send requests to the server.
The seriousness depends on two things. First, what is needed to trigger it: some flaws need a valid login, others do not. Second, how easy it is: a flaw that needs rare conditions is harder to use than one that works every time. Both end up in the CVSSCVSS is a score from 0 to 10 that shows how serious a security weakness is, so you can see at a glance which problems to deal with first. vector of the CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. record, which is why a score of 9 or higher is mostly given to RCE.
Why one flaw can touch many sites
When the weakness sits in the PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. runtime itself, it is not specific to one site. Every site served by that PHP installation is in scope, whatever CMSA content management system (CMS) is software that lets you edit the pages, texts and images of your website by logging in, without writing any code. it uses and however clean its own code is. The same holds for a flaw in the web serverA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files. or in a shared pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop..
What it means for a PHP or WordPress site
On a shared host, one server can carry many sites. If PHP there is vulnerable to RCE, a flaw in one site can become a flaw in the others, which is another reason to update the runtime and not only the plugins. The way PHP is attached to the web server matters too: PHP-FPMPHP-FPM is a helper on your hosting that runs your site's PHP code as a separate job and hands the finished page back to the program that answers visitors., mod_phpmod_php is an older way of running PHP, in which PHP is built into Apache, the program that answers visitors, instead of running as a separate helper. and similar setups all handle web requests, and some are considered more exposed than others in a given advisory.
In plugins, RCE often arrives through file uploads, unsafe handling of serialized data or code that runs what a request supplies. These are the kinds of mistakes that a regular update fixes, provided the plugin is still maintained.
A concrete example
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities. According to php.net they can allow unauthenticated remote code execution. The CVE records describe CVE-2026-109618 as RCE via OOM corruption and CVE-2026-109619 as RCE via stale global state, and both are rated CVSS v4.0 9.2. php.net names all PHP installations serving web requests as at risk, with mod_php as the highest risk, and says it has no report of exploitation in the wild. The PHP2Shell page lists each fact with its source and the time we checked it.
When to act
An RCE flaw in software you run is a reason to update within days. First find your version: your hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. panel or a phpinfo page shows it, and you can check your PHP version with the free tool to see what outsiders can read. Then install the fixed release, or ask your host when it comes. Make a fresh backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. of files and database before you update.
If you cannot update today, php.net lists temporary settings that reduce exposure but do not make a site safe, so use them as a stopgap only. If your PHP branchA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. no longer receives fixes, ask us about how we update PHP in WordPress. If you suspect a site has already been used, we can fix your WordPress website. Read exploitAn exploit is a piece of code or a method that turns a software weakness into a real attack. A proof of concept only shows that the attack works. for how the attack side works.
Frequently asked questions
Why is RCE called the most severe type of flaw?
Because running code on the server gives an attacker the same abilities as the software itself: reading files, changing pages, reaching the database. Other flaw types usually give a narrower result.
Does RCE always need a login?
No. Some RCE flaws need an account first, and others can be triggered without logging in. The advisory and the CVSS vector tell you which kind it is. An unauthenticated flaw is more serious because anyone who can reach the server can try it.
Is an RCE flaw the same as a hacked site?
No. It is a weakness that could allow an attack. A site is only compromised if someone has used it. Updating to a fixed version closes the weakness.
What should I do when an RCE flaw is announced in PHP?
Find your PHP version, compare it with the maker's advisory and install the fixed release, or ask your host when it ships. Make a fresh backup first, and use temporary settings only as a stopgap.