Critical PHP Security Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

Wed, 21 Oct 2026 10:00:00 +0100

Update 22/10/2026 3:07PM

Websites created from 1 September 2026 have been patched.

Websites created before this date may still be disrupted whilst upstream vendors work to patch.

Please note, your PHP version will still show as PHP 8.5, but the build date will display as 21st October.

—–

As you may be aware, two critical PHP security vulnerabilities have been announced by the PHP Security Team.

As of two weeks ago, all client websites are on PHP 8.5 owing to earlier optimisation of the web hosting stack I offer.

For the avoidance of doubt, this also includes websites created before 1 September 2026 (legacy), where I am still responsible for maintenance/updates and have access to cPanel.

PHP 8.5 is the latest supported version, and means all websites hosted by PatrickFound., or where I maintain a website on your own server, will recieve the critical updates required.

Upstream vendors have confirmed the following:

Emergency maintenance is being performed to keep sites protected and upstream patches are being implemented as they become available.
Additional protections have been put in place to mitigate risk.

Websites created before 1 September 2026 may experience temporary interruptions.

CMS Websites Created Before 1 September 2026 on PatrickFound. Status

Critical PHP Security Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)