Skip to content

Emergency PHP security update (CVE-2026-109618, CVE-2026-109619)

On 21 October we installed the emergency PHP security release, which fixes two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). Some pages loaded slowly or returned errors while PHP was being updated. All services now run patched PHP and are operating normally.

Minor Resolved

Updates

Timeline

  1. Identified

    Today the PHP project released fixes for two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2). They affect PHP applications broadly, so we started updating PHP on our servers right away. While PHP is updated and restarted, some pages may load slowly or return errors.

  2. Resolved

    Our servers are now on the patched PHP releases (8.2.35, 8.3.36, 8.4.27 and 8.5.12). codepreneurlabs.com, yourdiai.com, ordvaro.com and our API & infrastructure are running normally, and monitoring shows every check passing. You don't need to do anything. Sorry for the slowdown and errors while we updated.