On October 21, the PHP project released emergency patches for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting essentially every version of PHP. Both can allow a remote attacker to run code on an unpatched server, so we are treating this as a top-priority issue.
What we're doing
We began mitigation before the patches were even released and have been working through our infrastructure since. Our response includes:
- Web application firewall rules deployed across our servers to block the known attack paths
- Server-level protections applied to reduce exposure ahead of patching
- Patching every supported PHP version (8.2, 8.3, 8.4, 8.5) to the fixed releases
- Securing sites on older PHP versions using vendor-backported fixes
What this means for you
To keep your sites secure, some changes may be unavoidable:
- Brief interruptions are possible as we restart PHP services on each server. These are typically a few seconds per site.
- Some sites on end-of-life PHP versions (7.4, 8.0, 8.1) may need to be moved to a newer, supported version. Where that's necessary, we'll be in touch directly, as it can occasionally affect older plugins or code.
- If your site uses a very old PHP version, we may contact you about an upgrade timeline. This vulnerability makes staying on unsupported PHP a real risk, not just a best-practice recommendation.
We'd rather risk a short interruption than leave a site exposed to an actively discussed exploit. If you notice any issue with your site over the next few days, let us know and we'll prioritize it.
If your site runs on an older version of PHP, now is the time to move to a supported version (8.2 or newer). We can help — open a ticket and we'll walk you through it, and we may also reach out directly if your site is affected. Staying on outdated PHP is the single biggest risk here.
Wednesday, October 21, 2026