Every website we host now runs a version of PHP that fixes the two critical PHP vulnerabilities announced on 21 October 2026. You don’t need to do anything.
What the vulnerabilities are
The PHP project announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can let someone who is not logged in run their own code on a server that handles web requests with an unpatched PHP. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The details are in the advisory on php.net.
What we did
The websites we host run PHP 8.3. We installed PHP 8.3.36 on all six of our servers on 21 October between 5:18 and 5:42 p.m. EDT (21:18 to 21:42 UTC) and checked each server afterwards. By 5:50 p.m. EDT (21:50 UTC), every PHP process serving a site was running the new version.
The hosting control panel runs on its own copy of PHP. On 21 October Plesk, who make the panel, released an update that moves the panel’s PHP to 8.4.27, listed in Plesk’s change log as Plesk Obsidian 18.0.81 Update 4. We had it installed on all six servers by 8:33 p.m. EDT, 21 October (00:33 UTC, 22 October).
What you need to do
Nothing, for any site hosted with us. If you also run PHP somewhere else, check its version against the fixed releases listed on php.net. PHP 8.1 and older no longer get updates from the PHP project, so upgrade those to a supported version or ask your vendor for a backported fix.
Questions about your site? Open a ticket in the client area at my.webops.host, or write to support@webops.host.
