May website, online store, booking system, o business portal ka ba? Contact your developer or hosting provider today and ask whether it uses PHP and has the current security fixes.

What happened?

On October 21, 2026, PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can allow an attacker to run code on an affected server without logging in. PHP installations serving web requests need urgent attention.

Send this to your developer or hosting provider

"Does our website or business system use PHP? Are we affected by CVE-2026-109618 or CVE-2026-109619? Please confirm the security fixes are installed and active, and test our key features after the update. If patching is delayed, what protection or temporary isolation do you recommend?"

What should your developer confirm?

  • Check each website, subdomain, portal and deployment that uses PHP.
  • Verify the actual running web-server PHP package, including vendor-provided patches.
  • Prepare a backup and recovery plan, apply the appropriate fix and activate the updated runtime.
  • Test logins, forms, bookings and checkout where relevant.
  • Explain any remaining actions and review suspicious activity where appropriate.

The fixed upstream releases announced on October 21 are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. A hosting or operating-system vendor may provide a backported fix under a different package version, so ask for confirmation for your specific build. Older unsupported versions need an upgrade or a verified vendor fix. Temporary workarounds do not fully resolve these flaws.

Does this mean our website was hacked?

Being vulnerable does not by itself prove a compromise. A website can look normal while vulnerable software runs underneath it. Have your developer establish your patch status and assess whether further investigation is needed.

Need help identifying the next step?

Contact RDahunan I.T. Services for guidance. Hindi sigurado kung sino ang dapat kontakin? Message us.

Official sources

Information checked: October 22, 2026 (Philippine time). Recheck the official advisory before acting on a later date.