Critical security flaws in PHP
Severity score
9.2/ 10
CVSS v4.0
Two critical security flaws
Does your website run on PHP? Have someone check whether your server is already updated.
Two serious security flaws have been found in PHP. In some situations they can be abused without anyone logging in first.
That does not automatically mean your website has been hacked. It does mean you should quickly check whether the security update is installed.
We check which PHP version you use and whether the security update is installed. If action is needed, we make a backup first, install the update in a controlled way and then test the website.
4.6/5 · 381 Google reviews
The security update is now available
PHP has published the official security update. Do you use PHP for your website or web application? Then check whether your server has already been updated.
Announced for 21 October 2026 at 16:00 Belgian time (CEST).
What we know now
- Two critical security flaws, severity score 9.2 out of 10
- The official security update is available
- PHP strongly recommends updating immediately
- There is no complete temporary fix; updating is the safe solution
Who should have this checked
This can matter for websites that run on PHP. Not every website carries the same risk. A check shows whether your site needs attention.
- WordPress and WooCommerce
- Magento
- Laravel
- Custom PHP
- Business websites and internal applications
What R.A.V.E.N. can do
- 01
We check your website
We look at which PHP version, website software and server you use.
- 02
We see whether you are at risk
Not every website is the same. We check whether this vulnerability matters for your situation.
- 03
We look at temporary measures
They can reduce the risk if the update has to wait a little. They do not make the installation safe, and they do not replace the official update.
- 04
We install the security update
We make a backup first, then apply the official update in a controlled way.
- 05
We test everything again
We check your website, forms, login, uploads and webshop so you know everything still works.
Temporary security measures can reduce the risk, but they do not replace the official update. PHP says there is no complete temporary fix. Updating is the safe solution.
Technical details
- PHP 8.5→ 8.5.12
- PHP 8.4→ 8.4.27
- PHP 8.3→ 8.3.36
- PHP 8.2→ 8.2.35
CVE-2026-109618 and CVE-2026-109619. Both are critical, with a severity score of 9.2 (CVSS v4.0).
Using an older version, or not sure which version is running? Have it checked. Older versions may receive a separate security update through your host or Linux distribution.
Have your website checked
A short note is enough. We will contact you to plan the check.