Last week PHP shipped emergency fixes for two critical vulnerabilities. If your site runs PHP 7 or older, no fix is coming.
Both flaws (CVE-2026-109618 and CVE-2026-109619) are rated 9.2 and allow remote code execution without logging in. In plain terms, someone could run their own code on your web server.
The patched versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If you’re on one of those branches, updating is quick, and you should do it now.
If you’re on PHP 8.1 or earlier, there’s nothing to install. The only route is an upgrade, and on older sites that usually means code changes rather than a version switch: deprecated functions, outdated plugins and frameworks, and hosting configuration, all tested before it goes live.
If you’re on 8.2, it reaches end of life on 31 December, so plan the next step now rather than in January.
We’re a small, senior team in London, and the people who scope the work are the people who do it.
If you’re not sure which version you’re running or what an upgrade would involve, get in touch: highdigital.co.uk/contact
cybersecurity
PHP
Web Development
