Dear Customer,
Systron Micronix urges customers running PHP on their servers to apply the latest security updates immediately.
The PHP team has released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that can allow an unauthenticated attacker to execute code on an affected server.
Who should take action?
Customers operating PHP-powered websites, applications or APIs should review their installations urgently. This includes environments hosting WordPress, Drupal, Joomla, Magento, WHMCS, Laravel and other PHP applications.
The vulnerabilities affect PHP itself. Updating your website software or plugins alone does not replace the required PHP security update.
The official advisory identifies PHP installations serving web requests as at risk, including PHP-FPM, Apache mod_php, PHP-CGI, FrankenPHP and LiteSpeed.
Security updates available
The PHP team has released the following fixed versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Your operating system or PHP package provider may supply a backported security fix under a different package version. Check its security advisory to confirm that both vulnerabilities are addressed.
What you should do now
-
Identify every PHP installation. Check the PHP versions used by each website, application, container and hosting account. Running php -v checks the command-line version, which may differ from the version serving your websites.
-
Confirm your backups. Ensure you have a recent, usable backup of application files, databases and configuration before updating.
-
Apply the security patches promptly. Use your operating system’s package manager, hosting control panel or supported PHP provider. If your repository has not published an update, contact its maintainer or your server administrator urgently.
-
Restart affected services and verify the update. Follow your provider’s instructions to ensure PHP workers load the patched software. Check websites, logins, checkout processes and scheduled tasks afterwards.
-
Address unsupported PHP versions. PHP 8.1 and older are outside normal PHP project support. Confirm whether your vendor supplies a fix and plan migration to a supported release. Do not assume an older installation is protected.
-
Review for suspicious activity. Investigate unexpected files, unfamiliar accounts, unusual processes, modified scheduled tasks and abnormal access logs. Installing a patch does not remove an existing compromise.
If you cannot update immediately
Restrict access to non-public applications where practical and consult your security provider about applicable protective rules. Access restrictions and WAF rules are not a substitute for patching. The PHP team states that an update is the only complete solution.
Responsibility and support
For self-managed VPS, cloud servers and dedicated servers, installing and verifying software security updates is the customer’s responsibility.
If you have a managed service, or are unsure who maintains your PHP installation, please open a support ticket through your Systron Micronix client area. Include your server or service details so our team can clarify the applicable support scope and advise on next steps.
Please treat this update as a priority.
Systron Micronix Support Team
Official details: PHP security announcement and release information
