The PHP development team has released urgent security updates addressing two critical vulnerabilities that could allow attackers to execute code remotely on vulnerable web servers.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 under CVSS 4.0. PHP has urged administrators to update affected installations immediately.
GamDNS has applied the security patches to its affected systems. We take the security and reliability of our infrastructure seriously and treat critical software updates as a priority.
What are the vulnerabilities?
The flaws affect PHP itself, rather than a particular website or content management system. Under certain conditions, they can allow an unauthenticated attacker to execute code on a vulnerable server.
PHP has identified affected web-serving configurations including PHP-FPM, Apache with mod_php, CGI-based deployments, FrankenPHP and LiteSpeed. The risk is particularly serious for Apache configurations using mod_php, for which PHP reports a demonstrated exploit.
Because these vulnerabilities affect the underlying PHP runtime, updating WordPress, themes or plugins alone is not sufficient.
Which PHP versions are affected?
The PHP project has released the following patched versions:
| PHP branch | Security-fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Administrators should update to the appropriate fixed release or the corresponding security-patched package provided by their operating system vendor.
PHP 8.2 is approaching end of life on 31 December 2026, so administrators using this branch should also plan to migrate to a supported version.
What should website owners do?
If your website runs PHP on a server you manage, check which version serves your website and apply the appropriate security update. Remember that the command-line PHP version may differ from the version used by your web server.
If your website is hosted by another provider, contact them to confirm that the affected PHP runtime has been patched.
Keep your website applications, plugins and themes updated as well. These measures complement, but do not replace, securing the underlying server software.
Our commitment to security
At GamDNS, we believe dependable hosting involves more than keeping websites online. It also means maintaining the software and infrastructure those websites depend on.
We will continue to monitor relevant security announcements and apply appropriate updates to our affected systems.
Running a website? Don’t ignore security updates. Contact your hosting provider if you are unsure whether your PHP installation is protected.