If you host with us, you're patched! Here's the whole story
Yesterday was a big day for PHP. If you're a hosting customer with us: take a breath, your sites are already running on patched, safe versions of PHP. We started rolling updates onto our client app servers as early as 11:00 AM PST. These came first because patched Docker and FrankenPHP images were available before the Remi repos had their packages ready, and the final patches landed on the last of our pooled web servers at ~3:30 PM PST. No downtime, no drama, no action needed on your end.
Now, in case you're curious, here's what went down.
What happened
On Tuesday, the PHP security team published an advance notice of an upcoming security release, scheduled for Wednesday, October 21 at 14:00 UTC. That one day of warning was enough for us and every serious ops team on the planet to get ready. Time to buckle up!
Right on schedule, PHP shipped patched versions for all current PHP runtime versions. It was a coordinated security release fixing two critical vulnerabilities, both rated CVSS v4.0 9.2, both capable of unauthenticated remote code execution:
- CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) — RCE via OOM corruption. Out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat that invalid data as valid.
- CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) — RCE via stale global state. Request-owned internal state can survive after its backing memory is freed, letting a later request on the same worker use stale state before initialization resets it.
YIKES! The PHP project was blunt about it: there are no complete mitigations. Configuration tweaks can narrow some attack paths, but updating is the only real fix. That's exactly what we did and now every runtime in our hosting fleet now runs a version with both fixes applied.
A masterclass in coordinated disclosure
We want to take a moment to appreciate what the PHP core team pulled off here, because it isn't luck.
The disclosure playbook was near perfect. Responsible reporting, an advance public heads-up with a precise release time, patches pre-shared with Linux distributions and LTS vendors, and even minimal source-backports published for PHP 7.4, 8.0, and 8.1 (older PHP versions that aren't supposed to be maintained anymore) so people stuck on ancient versions still had a lifeline. Full technical writeups went live the same hour the fixes did. Transparency like that is virtually unheard of, and it makes everyone's ecosystem safer.
The distro maintainers deserve a round of applause too. Because they received the patches ahead of time, updated Rocky Linux packages were ready wicked fast. For a small shop like ours that kind of turnaround is the difference between "patched within hours" and "let's hope for the best!" It just worked. We pulled the packages, restarted the pools, verified, and moved on with our day.
That's the open source community at full strength: researchers reporting responsibly, core maintainers shipping fixes, distro packagers turning around builds at speed, and security tools like the CrowdSec community sharing indicators while the non-tech world slept. Just another reason why the OFC team loves that funky lil thing called PHP.
What this means if you host with us
- Your site's PHP runtime is on a patched release (8.3.36, 8.4.27, 8.5.12).
- Updates were applied in a rolling fashion across the fleet, your site never went down during this process.
- We're on the distribution-supported path, so future security releases hit us the same day, not the same week.
One thing worth flagging: PHP 8.2 reaches end of life on December 31, 2026. If your application is still pinned to 8.2 (please please please tell us it's not older), now is the time to start the jump. We handle compatibility triage, deprecation sweeps, and staged rollouts for exactly this reason. Don't know what any of those terms mean? No problem, we also do security audits and consulting. Open a ticket and we'll take it from there.
Stay patched out there. And here's to the hundreds of people who made yesterday as boring as possible. Long live PHP!