Critical PHP security vulnerabilities

Update timeline

1. investigating Oct 21, 2026, 04:30 AM UTC

   We are aware of a security issue affecting PHP, the language many of our clients’ applications run on. In short The PHP team is due to release a fix today, 21 October, at 15:00 UK time. We are preparing to apply it to all affected systems we manage as soon as it is available. Until then, the only way to remove the risk completely is to take an application offline temporarily. If you have any concerns, or would like us to take your application offline until it is patched, please get in touch. What has happened Yesterday (20 October) the PHP security team announced an emergency release to fix two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 out of 10 for severity. If exploited, they could allow an attacker to run their own code on an affected server. Overnight, details of the vulnerabilities appear to have been published online ahead of the planned fix. This means they could be exploited before the patch is available. We have no evidence either way at this stage, so we are treating the risk seriously. Mitigation No workarounds have been published so far. Until the fix is applied, taking an application offline is the only way to remove the risk completely, but it also means the service will be unavailable for that period. If a workaround becomes available, we will post an update here. Fixes are only expected for currently supported versions of PHP. If your application runs on an older version, it may need to be upgraded before the fix can be applied. We will contact any clients this affects directly. What we are doing Our team has been monitoring the situation throughout the night and is preparing to patch every affected system we manage as soon as the fix is released. We will post further updates here as the situation develops.