CyberPulse Security Notice | Check Your PHP Version and Recent Security Updates

Recent PHP security updates deserve attention from website administrators. If your website or server uses PHP, we recommend checking the version actually running right away and applying the appropriate fixes according to the security advisories from the PHP project and your operating system distribution.

[Important] A website that does not disclose its PHP version is not necessarily free of PHP vulnerabilities. When an external scan cannot identify the version, that alone does not mean the system is secure or has been fixed.

We recommend that system administrators check the PHP version, package patch status and the runtime environment actually in use from inside the server.

[Information published by the PHP project (October 21, 2026)] ・On October 21, 2026, the PHP project fixed two Critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. According to the project, they may allow an unauthenticated attacker to execute code remotely. ・Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Earlier releases in the 8.2–8.5 branches are affected. ・PHP 8.1 and earlier no longer receive updates from the PHP project. Some operating system distributions or long-term support vendors may provide backported fixes; please check with your vendor, or upgrade to a supported version. ・Because of the severity, the PHP security team has also provided minimal source backports for PHP 7.4, 8.0 and 8.1 (published as branches in the php-src GitHub repository). Sites still on these versions can refer to them, but should still plan to upgrade to a supported version. ・PHP 8.2 reaches end of life on December 31, 2026; if you run 8.2, please plan your upgrade as well. ・PHP installed from operating system packages may carry version numbers that differ from the official ones; use your distribution's security advisories to determine whether it has been patched. ・The project states that temporary configuration changes only reduce part of the risk, and updating is the only complete fix.

Official advisories: https://www.php.net/archive/2026.php#2026-10-21-5 https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

CyberPulse will keep improving how external vulnerability checks are assessed and how fixes are verified.