PHP RCE CVE-2026-109618 & 109619: Patch PHP for WordPress
PHP fixed two unauthenticated RCE bugs on Oct 21, 2026. See which PHP versions are safe, how to patch and restart PHP, and the stopgaps to use meanwhile.
💡 wp-config.php file is one of the most important files in a Wordpress installation. It contains your website’s base configuration details, such as database connection information.
Here you can find all those damned wp-config constants you can never remember.
PHP fixed two unauthenticated RCE bugs on Oct 21, 2026. See which PHP versions are safe, how to patch and restart PHP, and the stopgaps to use meanwhile.
I recently did a guide on 5 (Less known) WordPress Security Tips to keep your website safe from hackers where I suggested moving wp-config.php outside the web root directory as a simple change that adds an additional layer of security to your WordPress website. The wp-config.php file contains your MySQL database username & password, along with … Read full article →
Here are some examples of security configurations that can be added to your WordPress website’s wp-config.php file: Disable file editing define( ‘DISALLOW_FILE_EDIT’, true ); This configuration will disable the built-in WordPress file editor, which can prevent users from accidentally or intentionally making changes to the core WordPress files. Change the default database table prefix $table_prefix … Read full article →
We occasionally find ourselves in a situation where we need to test the website first, then point the domain name if everything is in order. To achieve this there are multiple ways: Edit Hosts file on your local computer Use online service such as skipDNS Access WordPress using temporary server URL In this guide We … Read full article →
Post revisions are a WordPress feature that allows you to undo changes and go back to an earlier version of your posts and pages, it works by auto-saving every 60s while you edit content. Since revisions can take up a lot of space in the database, it is a good idea to delete them. or You … Read full article →
The constant FS_METHOD determines the filesystem method that WordPress should use for reading, writing, modifying, or deleting files. To set a different method for file editing, simply edit your wp-config.php file and add the line: The FS_METHOD forces the filesystem method and accepts the following values: Method Description direct Use Direct File I/O requests from within … Read full article →
In short: WP_MEMORY_LIMIT is the default limit set for the front end, but it can be raised up to WP_MAX_MEMORY_LIMIT in wp-admin pages. WP_MEMORY_LIMIT WP_MEMORY_LIMIT allows you to specify the maximum amount of memory that can be consumed by PHP. This setting may be necessary in the event you receive a message such as “Allowed memory size of X … Read full article →
WordPress.org has a list that explains the default and most commonly used wp-config.php constants. But there are many more constants that are not covered in this guide and can only be found when browsing the WordPress core itself. Here I will do my best to list all WordPress constants, and keep the list up to … Read full article →
The SAVEQUERIES wp-config constant saves database queries to an array and We can use that array to display queries. The information saves each query, what function called it, and how long that query took to execute. To enable SAVEQUERIES add this to the wp-config.php file: Then in the footer of your theme put this: <?php … Read full article →
Want to change the domain name for your WordPress website? No problem, in this guide We’ll walk you through 5 different methods to change the domain name for a WordPress website from cPanel PHPMyAdmin. Before following this guide make sure you’ve down the following: registered the desired domain name and pointed it towards your hosting … Read full article →