Current Status of the PHP Security Vulnerabilities from October 2026
Status: 22 October 2026, 14:00 – All required security updates have been completed.
Security Updates Completed
On 20 October 2026, two critical vulnerabilities in PHP were publicly disclosed. Green has installed the necessary security updates on all affected web hosting systems. This means that both security vulnerabilities have been fixed on the corresponding systems.
The installation of all required security updates has been fully completed.
Have the Critical PHP Vulnerabilities on My Hosting Already Been Fixed?
Yes. Green has installed the security fixes for the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 on all affected web hosting and managed systems.
The updates were fully implemented by 22 October 2026. You therefore do not need to make any changes to your website's PHP version.
What Is the Background of the Security Vulnerabilities?
The vulnerabilities CVE-2026-109618 and CVE-2026-109619 are found in PHP, a programming language used by WordPress and many other web applications, for example.
Under certain conditions, attackers could exploit these vulnerabilities to execute their own program code on an affected server without authorisation. Since the causes lie within PHP itself, this is not a problem that exclusively affects Green systems.
The PHP project released the corresponding security fixes on 21 October 2026.
Which PHP Versions Are Affected by the Vulnerabilities?
The affected versions include various PHP releases, including versions 8.2, 8.3, 8.4 and 8.5. Older PHP versions may also be affected.
The necessary fixes have already been installed on the affected Green web hosting systems. Switching to a different PHP version was not required.
Was My Website's PHP Version Changed?
No. The security fixes were provided and installed for the PHP version already in use. Your website was not automatically switched to a newer or different PHP version.
This approach helps to avoid potential incompatibilities. Changing versions could, for example, affect your content management system, installed plugins, the themes you use or custom-developed applications.
Why Does My Monitoring Still Show the Previous PHP Version?
Security fixes are integrated into the PHP packages provided by us using, among other methods, a process known as backporting. This involves incorporating the required changes into the existing PHP version without changing the displayed version number.
The actual PHP version number therefore remains the same. Instead, the internal release version of the corresponding package is updated.
The fixes for CVE-2026-109618 and CVE-2026-109619 were also integrated in this way. Therefore, external security scans or the PHP information page phpinfo() may continue to display the same PHP version number as before the update.
If you would also like to verify the patch status, you can check the Build Date in the phpinfo() output. A Build Date of 21.10.2026 indicates the updated version. You can find this information near the top of the page, directly below the PHP version.
In this case, the fact that the displayed PHP version number has remained unchanged does not mean that the security fixes are missing.
Are Any Further Measures Required on My Part?
No. Green has already installed the necessary security updates directly on the affected web hosting systems. You therefore do not need to take any additional steps to have these two security vulnerabilities fixed.
Regardless of these updates, it is advisable to use a current and officially supported PHP version on your website. Regularly updating the applications you use also continues to be recommended.