Today October 21 at 16:30, we have successfully applied the critical PHP security updates across our infrastructure.
Patches
The patches address two unauthenticated remote code execution (RCE) vulnerabilities:
- CVE-2026-109618
- CVE-2026-109619
Mitigation
- All PHP installations have been updated to the latest patched version: 8.5.12
- Restarted all web workers and application pools.
Sources