Critical PHP Vulnerabilities: What epochLABS Clients Need to Know

If your website or web application runs on PHP, update it now. On 21 October 2026 the PHP project released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which can let an attacker run their own code on your server without logging in.

PHP powers a large share of the web, including WordPress, Drupal, Joomla, Magento and many custom-built sites. Attacks were already seen before the fixes came out, so this is not one to leave until next month's maintenance window.

What We Do (and Why You Should Care)

epochLABS builds and hosts PHP applications for our clients, from custom web apps to hosted WordPress, Drupal and Symfony installations. If your PHP site is managed by us, we've already patched our systems. This post is for clients who manage their own hosting, and as a reminder of what responsible PHP management looks like.

Unlike hosting platforms that simply provide a server and leave you to manage it, our managed PHP hosting model means we're actively updating, monitoring and maintaining the platform stack — including emergency patches like these. If you're running PHP on unmanaged hosting or managing your own server, this is where you need to act fast.

What Happened

On 20 October, details of both flaws leaked online ahead of their planned disclosure, and the PHP project warned administrators that emergency patches were coming. The next day, 21 October, it released fixed versions and published full details. Because of the leak, attackers had a head start: researchers and Cloudflare reported attack traffic before the patches were out.

In technical terms, both are memory-handling bugs inside PHP itself. That means a site can be vulnerable even if its own code is well written.

Who Is Affected

Any server that uses PHP to handle web requests is at risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates mod_php setups as the highest risk, because the attack works before your site's own code even runs.

You may be running PHP without realising it. Common places it hides:

• Content management systems such as WordPress, Drupal and Joomla
• Online shops, booking systems and customer portals
• Hosting control panels and webmail
• Network appliances, monitoring dashboards and admin tools
• Docker containers and images built on top of PHP

Singapore's Cyber Security Agency specifically advises checking for PHP inside third-party applications, even if your main website doesn't use it.

What to Do Now

Upgrade to a fixed version as soon as possible, starting with anything reachable from the internet. The fixed versions are:

• PHP 8.5: 8.5.12 or later
• PHP 8.4: 8.4.27 or later
• PHP 8.3: 8.3.36 or later
• PHP 8.2: 8.2.35 or later
• PHP 8.1 or older: no official fix — plan an upgrade

Steps to Take

1. Find every PHP installation. Check all websites, servers, containers and any appliances or tools that might bundle PHP.
2. Patch. If you're on shared or managed hosting, ask your provider to confirm they have applied the fix. If you manage your own server, update PHP directly.
3. Check the patch really landed. Linux distributions such as Ubuntu and Debian often backport fixes without changing the version number, so a normal system update may or may not include it. Check your distribution's security notice for CVE-2026-109618 and CVE-2026-109619.
4. Deal with old versions. PHP 8.1 and older no longer receive security updates from the PHP project. These sites need an upgrade or migration plan, not just a patch.
5. Look for signs of compromise. Because attacks started before the fix, check for unexpected processes, new files or user accounts, and unusual outbound connections from your web server.

For full technical details, see the PHP project's announcement and the Canadian Centre for Cyber Security alert.

If You're Unsure

This is where managed hosting shines. If you're:

• Running PHP on unmanaged hosting or your own server — talk to us about moving to a managed PHP platform. We handle patches, updates and monitoring so you don't have to.
• Stuck on an older version of PHP — that's a real problem. We can help you plan a safe upgrade or migration path so you're not left without security fixes.
• Not sure whether you use PHP at all — we can audit your sites and tell you exactly what's running and what needs doing.
• Managing multiple client sites — if you're an agency or reseller, epochLABS's multi-tenant PHP hosting platform simplifies compliance, patching and version management across your whole portfolio.

The cost of a security breach is always higher than the cost of staying current. Get in touch and let's make sure you're protected.

Contact epochLABS — we'll help you work out what's affected and get it fixed.

‍