PHP security · October 21, 2026

Start with the official advisory.

PHP’s October 21 advisory describes CVE-2026-109618 and CVE-2026-109619 as critical vulnerabilities with remote code execution risk. It identifies fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Installations serving web requests are in scope. Distribution or hosting packages may use backported fixes, so the displayed version alone may not settle patch status. Confirm the applicable package and update with your provider.

Use the current vendor guidance.

Read the official PHP advisory for authoritative release and mitigation details. This guide summarizes how to organize the work; it is not a substitute for the advisory.

Confirm what is actually running.

Start with an inventory of sites, hosting providers, and the people authorized to make changes. A portfolio may use different PHP pools or hosting accounts even when the sites share a CMS.

Ask your host or technical team to confirm the runtime serving web requests for each affected environment, which update or vendor backport applies, and how the deployed result will be checked. Record uncertainty rather than treating an unanswered question as confirmation of safety.

For ongoing planning, the PHP supported versions page explains upstream support status. A legacy environment needs a longer-term path as well as an immediate response.

Turn the finding into coordinated work.

Agree who owns the host-level update and who validates the application. Include CMS extensions, custom integrations, and important workflows in the discussion. A runtime change and an application update may need different people and different access.

  1. Establish the scope. List the sites and dependencies that need review.
  2. Prioritize the response. Agree urgent actions with the responsible technical team.
  3. Plan validation. Include forms, login, checkout, background tasks, and integrations as appropriate.
  4. Record the result. Note the deployed state, the checks completed, and outstanding follow-up.

If there are signs of compromise, bring that into the conversation immediately. An update plan and an operational recovery plan are related, but they are not interchangeable.

Choose the right starting point.

Use the exposure checklist to collect the information your team needs. If the environment is unclear, start with a security assessment. If the findings are understood, review remediation and updates. For suspected compromise, explore recovery and hardening.

Agencies can group this work across client portfolios. Our agency support page explains how communication and responsibilities can be coordinated.