Update – Critical PHP vulnerabilities: remediation in progress Advania’s operations team has applied security updates to a large number of affected servers and services. Work to fix the vulnerabilities (CVE-2026-109618 and CVE-2026-109619) is continuing where this is possible. Servers that have not yet received a security update, or that run software no longer supported by its vendor, remain isolated for now. This notice will be updated as the work progresses.
Posted Oct 21, 2026 - 17:00 UTC
Identified
Update – Critical PHP vulnerabilities: security update released The PHP project released security updates on 21 October 2026 that fix both critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are no longer supported, and the PHP project will not release updates for them. Advania’s operations team is working through the affected systems. Some services will remain isolated while this work is ongoing. This notice will be updated as the work progresses. References:
CERT-IS and CERT-EU have warned about two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They could allow an attacker to run code remotely on a web server without logging in. Exploit code is circulating publicly. Any internet-facing web server running PHP appears to be exposed, whatever platform it uses. The PHP project will release a security update today, 21 October 2026, at 14:00 UTC. Advania’s operations team is preparing to apply it. Following the CERT-EU and CERT-IS recommendations, Advania is temporarily isolating some internet-facing services that run PHP until they have been updated. Affected websites and web applications may be unavailable or only partly available during this time. We cannot yet confirm how long the update will take or how it will affect individual services. This notice will be updated as the work progresses. References: CERT-EU Security Advisory 2026-018