Dear ElySpace Customer,
If your server runs PHP, an urgent security update requires your attention.
The PHP team has released patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS v4.0). According to PHP, these vulnerabilities can allow unauthenticated remote code execution (RCE), which puts every PHP installation serving web requests at risk.
We strongly recommend updating immediately to the patched release for your current PHP series:
- PHP 8.5 → 8.5.12
- PHP 8.4 → 8.4.27
- PHP 8.3 → 8.3.36
- PHP 8.2 → 8.2.35
Installed PHP through your Linux distribution?
Linux distributions and LTS vendors received these patches in advance. Please check your vendor for updated packages, and note that distribution version numbers may differ from those listed above.
Using Cloudflare?
Cloudflare has deployed Web Application Firewall (WAF) mitigations against these vulnerabilities. However, this does not remove the vulnerability itself. Updating PHP remains the only complete fix.
Can’t update right away?
PHP’s official security advisory outlines temporary measures to reduce exposure to specific attack paths until you can apply the update.
For the full advisory and update instructions, visit php.net.
We recommend prioritizing this update to protect your server and applications. If you need any assistance, our support team is here to help.
Best regards,
The ElySpace Team
