PHP Vulnerability Remediation · CVE-2026-109618 & CVE-2026-109619

Exposed to the New PHP Flaws?
We'll Get You Patched Fast

If you run WordPress, Drupal, Laravel, or custom PHP sites, chances are they're exposed to two new critical PHP flaws. Our team will:

Find every PHP install you run
Patch or upgrade it to a safe version
Lock down anything that can't be patched yet

Find every PHP installPatch or upgrade safelyFirewall & monitoring in place

PHP Emergency Patching

Get help patching PHP

Tell us what you run and we'll reach out to plan the fix.

What's Going On

Two critical PHP vulnerabilities

CVE-2026-109618 and CVE-2026-109619, publicly disclosed on October 21, 2026, are remote code execution (RCE) flaws: they let an attacker run arbitrary code on a server running PHP, potentially taking over the whole system. Proof-of-concept exploit code is already public.

Who's affected

Every PHP version from PHP 5 onward. If PHP runs anywhere in your infrastructure, treat it as in scope until it's patched:

WordPress, Drupal, Laravel, and custom PHP applications
Cloud servers and VMs (e.g. DigitalOcean Droplets)
Kubernetes workloads, app platforms, and custom containers
Marketplace / 1-Click images: WordPress, LAMP, LEMP, Laravel
Admin panels and legacy apps you may not think of as PHP servers

Patched versions

Update to at least:

PHP 8.5: 8.5.12
PHP 8.4: 8.4.27
PHP 8.3: 8.3.36
PHP 8.2: 8.2.35

On PHP 8.1 or earlier? Those versions are end-of-life and won't get a patch. You'll need to upgrade to PHP 8.2 or later first.

How We Fix It

We handle the patching for you

Hosting providers may restrict traffic to servers that show signs of compromise, so unpatched sites can go offline as well as get breached. Here's how our team gets you safe.

Find every PHP install
We inventory your servers, containers, and hosted apps, including bundled PHP you may not think of: WordPress and other CMS sites, admin panels, and legacy apps.
Patch PHP and the apps on top of it
We update PHP to a patched release and apply the software-specific updates your WordPress, Laravel, or other PHP apps need. Updating is the only safe fix; there's no complete workaround.
Upgrade end-of-life PHP
On PHP 8.1 or earlier, there's no patch coming. We upgrade you to PHP 8.2+ and test your applications against it so you can apply the fix.
Reduce exposure in the meantime
Where something can't be patched today, we apply the PHP Foundation's interim measures, take apps that don't need to be public off the internet, and put firewall/WAF rules and monitoring in place.