1
alain01
Upcoming Critical PHP Security Release
  • Yesterday 13:21

  • alain01

  • Just can't stay away

  • Posts: 547

  • Since: 2003/6/20


Hello,

https://www.php.net/archive/2026.php#2026-10-20-1

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2
9.2 / 10 so critical !!!

2
alain01
Re: Upcoming Critical PHP Security Release
  • Yesterday 14:05

  • alain01

  • Just can't stay away

  • Posts: 547

  • Since: 2003/6/20


https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

Quote:
PHP hasn't said yet, and watchTowr's FAQ lists both the affected versions and the fixes as "to be confirmed". CERT-EU's advisory says the flaws could affect all PHP versions from PHP 5 onward, citing a public post, and that no technical details are public. CERT-EU tells organizations to prepare for immediate patching. Where that isn't feasible, it suggests isolating internet-facing applications from public networks until a fix is available.

PHP currently supports the 8.2, 8.3, 8.4 and 8.5 branches, according to its supported versions page, and security support for 8.2 ends on 31 December 2026. PHP 8.1 and older are end of life. I don't expect an official fix for them, and Sansec says servers on 8.1 or older get none.

3
Mamba
Re: Upcoming Critical PHP Security Release

Our server has been updated to the latest security version of PHP
Support XOOPS => DONATE
Use 2.7.x | Docs | Modules | Bugs

4
alain01
Re: Upcoming Critical PHP Security Release
  • Today 9:49

  • alain01

  • Just can't stay away

  • Posts: 547

  • Since: 2003/6/20


For all :
To check whether your hosting provider has updated PHP,

Method 1:
- Create a file called infophp-wxyz.php with the following content:
<?php
phpinfo
();
?>
- Upload it to the root directory of your website and visit the page: mysite.com/infophp-wxyz.php
- Check the PHP version and, most importantly, the build date (21/10/2026 if your hosting provider has applied a patch)
- Delete the infophp-wxyz.php file as soon as you have viewed it.

Method 2:
If you have SSH access to your hosting account, type:
php -v

Result:
PHP 8.x.y (built: 21 Oct 2026 14:22:18)