Critical PHP Security Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

As you may be aware, two critical PHP security vulnerabilities have been announced by the PHP Security Team.

As of two weeks ago, all client websites are on PHP 8.5 owing to earlier optimisation of the web hosting stack I offer.

For the avoidance of doubt, this also includes websites created before 1 September 2026 (legacy), where I am still responsible for maintenance/updates and have access to cPanel.

PHP 8.5 is the latest supported version, and means all websites hosted by PatrickFound., or where I maintain a website on your own server, will recieve the critical updates required.

Upstream vendors have confirmed the following:

• Emergency maintenance is being performed to keep sites protected and upstream patches are being implemented as they become available.
• Additional protections have been put in place to mitigate risk.

Websites created before 1 September 2026 may experience temporary interruptions.