Emergency PHP security update (CVE-2026-109618 / CVE-2026-109619)
Impact: MajorCurrent status: Resolved
Started · Resolved On October 21, 2026, the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP’s core. Left unpatched, these flaws could allow an unauthenticated attacker to execute code remotely on affected servers. Germany’s Federal Office for Information Security (BSI) also issued a warning and urged operators to patch immediately.
We updated PHP across our web hosting platform to the fixed releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and both vulnerabilities are now closed for our web hosting customers. This was an emergency security update, not a service disruption, and no action is required from customers hosted on our platform.
If you run PHP applications outside our infrastructure, we recommend updating to a fixed release as soon as possible.Affected services: Hosting Services
We updated PHP across our web hosting platform to the fixed releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and both vulnerabilities are now closed for our web hosting customers. This was an emergency security update, not a service disruption, and no action is required from customers hosted on our platform.
If you run PHP applications outside our infrastructure, we recommend updating to a fixed release as soon as possible.Affected services: Hosting Services
References
- PHP release announcement
- https://www.php.net/archive/2026.php#2026-10-21-5
- BSI Security Advisory (German)
- https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.pdf?__blob=publicationFile&v=3
- EU-CERT Security Advisory
- https://cert.europa.eu/publications/security-advisories/2026-018
- NSA Security Advisory
- https://www.nsa.gov/press-room/press-releases-statements/press-release-view/article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/