On October 21, 2026, the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP’s core. Left unpatched, these flaws could allow an unauthenticated attacker to execute code remotely on affected servers. Germany’s Federal Office for Information Security (BSI) also issued a warning and urged operators to patch immediately.
We updated PHP across our web hosting platform to the fixed releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and both vulnerabilities are now closed for our web hosting customers. This was an emergency security update, not a service disruption, and no action is required from customers hosted on our platform.
If you run PHP applications outside our infrastructure, we recommend updating to a fixed release as soon as possible.