PHP Releases Emergency Fixes for Two Critical Security Flaws

The PHP project released emergency security updates on October 21 for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. The flaws can allow an unauthenticated attacker to execute code on a vulnerable web server.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project's advisory urges users to update immediately and says organisations using distribution or long-term-support packages should check their vendor for patched versions.

The UK National Cyber Security Centre is encouraging organisations to identify PHP installations, prioritise internet-facing systems and apply the updates. Its guidance also addresses systems that cannot be updated or mitigated promptly.

Cloudflare says it has deployed additional web application firewall protections, while stressing that customers should still patch PHP. The company explains that updating application code or a plugin alone does not repair a flaw in the underlying PHP runtime.

For a business owner, the immediate task is to find out who manages that runtime. It may be the hosting company, an internal administrator or the agency maintaining the website. A working homepage is not evidence that the server has been patched.

JetherVerse's practical takeaway is to request a clear status update for each affected website: the runtime or vendor package in use, whether the security fix has been applied and who verified it. Record the response rather than relying on a general assurance that updates are automatic.

After maintenance, check the customer journeys that matter. A login test, contact-form submission and representative checkout can help reveal compatibility problems that a quick visual inspection misses.

If the site is managed by a provider, ask for confirmation of the server update rather than attempting unfamiliar configuration changes yourself. Where exposure remains uncertain, involve the person responsible for infrastructure and incident response.

For businesses coordinating those checks, patch confirmation and post-update testing fit into JetherVerse's ongoing technical support work: https://jetherverse.com/services/technical-support