Two critical security vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to run malicious code through web requests without logging in. PHP has now released security updates addressing both issues.
Customers who manage their own VPS or dedicated server should update PHP immediately as patched packages become available from their operating system, control panel, or PHP provider. We will also apply these updates to our shared hosting servers as they become available through our supported update channels.
For shared hosting customers, we will handle the server-side PHP updates. Please continue keeping your website software, plugins, and themes current.
Customers with their own servers should check every installed PHP version, including versions assigned to individual websites. After installing the updates, restart the relevant PHP services and verify that websites are using the patched packages.
The PHP project lists 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as fixed releases. Some vendors provide backported security fixes under different package version numbers, so check your provider’s security notice. PHP states that configuration changes do not provide complete protection; updating is essential.
Please treat this as an urgent security update and apply the appropriate patches promptly.
Further information: Official PHP security announcement.
Customers who manage their own VPS or dedicated server should update PHP immediately as patched packages become available from their operating system, control panel, or PHP provider. We will also apply these updates to our shared hosting servers as they become available through our supported update channels.
For shared hosting customers, we will handle the server-side PHP updates. Please continue keeping your website software, plugins, and themes current.
Customers with their own servers should check every installed PHP version, including versions assigned to individual websites. After installing the updates, restart the relevant PHP services and verify that websites are using the patched packages.
The PHP project lists 8.2.35, 8.3.36, 8.4.27, and 8.5.12 as fixed releases. Some vendors provide backported security fixes under different package version numbers, so check your provider’s security notice. PHP states that configuration changes do not provide complete protection; updating is essential.
Please treat this as an urgent security update and apply the appropriate patches promptly.
Further information: Official PHP security announcement.