· By Nicholas “Nick” O'Sullivan, Townsville
Critical PHP vulnerabilities: what to ask your web host and software vendors
Emergency patching becomes harder when nobody is sure who owns the server, which applications use it or whether the hosting provider has already installed the fix. The October PHP security releases are a useful reason to close those gaps across school systems, business websites and community organisation platforms.
What was released?
On 21 October 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The fixed upstream releases were 8.2.35, 8.3.36, 8.4.27 and 8.5.12. These are the releases that addressed those flaws, not a recommendation to stop updating there. Check the PHP release announcements and advisory for details and use a currently supported, patched version appropriate to your application.
PHP also notes that distribution and long-term-support vendors may supply backported patches. An older-looking version string alone does not settle whether a vendor package is fixed: ask for the relevant package advisory and installed build. Unsupported installations need a supported upgrade path or documented vendor maintenance.
A plugin update does not update the whole server
WordPress’s security notice explains that these issues are in PHP and are not specific to WordPress. Updating WordPress, themes and plugins remains important, but it does not by itself replace the server’s PHP runtime. Responsibility may sit with your web host, internal IT team or application vendor.
Get a clear answer for each service
Send the person responsible a short set of questions:
- Does this service use PHP, including background jobs, integrations or older subdomains?
- Which runtime or vendor package is in use, and does its advisory confirm fixes for both CVEs?
- When was the patch deployed, and were the affected running services restarted or replaced as required?
- What functional checks were completed afterwards, including logins, forms, uploads and scheduled jobs?
- If work is outstanding, who owns it, when will it be completed and what temporary restrictions are in place?
Keep the response with the service record. For software operated by a supplier, request confirmation covering your service rather than assuming a general status-page message applies to every customer environment.
Plan the maintenance and the communication together
Before a change, confirm backups can be restored, identify compatibility risks and arrange the shortest practical maintenance window. If a fix cannot be applied promptly, have the responsible administrator assess isolation or temporary shutdown against the current advisory. A firewall rule may reduce exposure, but it is not evidence that the underlying flaw has been fixed.
Tell staff which workflow is affected, how urgent requests should be handled and when the next update will arrive. A precautionary shutdown does not by itself establish that a service has been breached. Equally, patching does not establish that earlier compromise was impossible; suspected incidents need investigation as well as updates.
Make the next emergency easier
Build a small register of websites and hosted applications with an owner, supplier contact, patching responsibility and recovery arrangements for each. Include dormant sites and systems someone set up years ago. Review the register when services change. These are exactly the operational questions worth including in a vendor assessment.
Recent MITIE discussion highlights schools sharing patching approaches and vendor impacts. MITIE is a useful community for school ICT professionals comparing practical responses. For your own organisation, Suburban Secure can help clarify ownership and prioritise the work.
