Dear Valued Customer,
The PHP development team released security updates on October 21, 2026, at 14:00 UTC, addressing two critical security vulnerabilities with a reported CVSS v4.0 score of 9.2 out of 10.
PHP powers a significant portion of the web, including hosting control panels, billing systems, content management systems (CMSs), and custom web applications. These vulnerabilities may affect servers and applications running vulnerable PHP versions.
Vulnerability Details
1. CVE-2026-109618: Remote code execution (RCE) via out-of-memory corruption.
2. CVE-2026-109619: Remote code execution (RCE) via stale global state.
Overview
- Affected Software: PHP
- Severity: Critical (CVSS v4.0: 9.2)
- Release Date: October 21, 2026, at 14:00 UTC
Recommended Actions
1. Back up your data: Ensure that all website files, application configurations, and databases have verified, restorable backups before applying updates.
2. Identify PHP versions: Check which PHP versions are used by your websites, applications, background processes, and control panels.
3. Install security updates: Update PHP using your operating system's package manager (e.g., apt, dnf, or yum) or hosting control panel (e.g., cPanel & WHM with EasyApache, Plesk, or DirectAdmin).
4. Restart relevant services: Restart PHP-FPM, Apache, or other relevant services as required to ensure that the updated code is loaded.
5. Verify PHP versions: Confirm that both the command-line PHP version and the version used by your websites are updated.
6. Address end-of-life (EOL) versions: Unsupported PHP versions no longer receive security patches. Migrate applications running on EOL versions to supported PHP versions as soon as possible.
7. Test application functionality: After updating, verify that your websites, API integrations, billing systems, and other critical applications continue to function correctly.
Security Best Practices
- Keep CMS platforms, plugins, themes, and application dependencies up to date with the latest security releases.
- Use a web application firewall (WAF) and restrict access to administrative interfaces.
- Enable automatic security updates where appropriate for your server environment.
- Monitor system logs and resource usage for suspicious processes, unexpected outbound connections, or unauthorized scheduled tasks.
Our Commitment
We are closely monitoring official security advisories and will apply relevant updates to infrastructure under our management in accordance with our security and maintenance procedures.
If you manage an unmanaged VPS or dedicated server, please ensure that the necessary security updates are installed and that your systems are running patched PHP versions.
For further technical information, please refer to the official PHP security advisories.
Thank you for your cooperation in helping us maintain a secure hosting environment.
Kind regards,
Technical Support Team,
CeylonServers
Giovedì, Ottobre 22, 2026
