23/10/2026
Could your PHP-powered website be exposed to a critical security flaw?
On 21 October, PHP released security updates addressing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
These flaws can allow attackers to execute code remotely without logging in on affected PHP deployments.
If your business relies on a PHP-powered website, application or online store, now is the time to check with your technical team.
4 questions worth asking today:
1. Which PHP versions are running across production, staging and test environments?
2. Have we applied the relevant security fixes? Patched PHP releases include 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Vendor-supported backports may also be available.
3. Have the relevant PHP services and workers been restarted so the updates are active?
4. If we're running PHP 8.1 or older, do we have a vendor-supported patch or upgrade plan?
A temporary workaround isn't the same as a security update.
PHP recommends updating immediately, and PHP 8.2 reaches end of life on 31 December 2026.
Need additional technical capability?
Tekkon's Nepal-based DevOps specialists can work directly alongside your team to assess PHP versions, plan updates and support approved changes.
Message us with "PHP check" or email [email protected] to discuss your requirements and availability.
Official PHP security advisory:
https://www.php.net/archive/2026.php #2026-10-21-5