Two critical PHP vulnerabilities: fixes deployed across all2all
On 21 October 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated remote code execution.
all2all installed the security updates on all its web hosting servers immediately after they were published, shortly after 16:00 Brussels time. Recent PHP versions received the new fixed releases; older versions used on our hosts also received backported security fixes.
This work does not change the major PHP version selected for each website.
Older PHP versions have also received the fixes
The updates also cover older PHP versions still used on our hosting platform. Packages from the Sury repository provide backported security fixes for these versions.
A backport adapts a fix to an older PHP branch without requiring a move to a new major version. It addresses the vulnerability while preserving compatibility with existing websites as far as possible.
Why does the version number appear unchanged?
For these older branches, the PHP version number can stay the same: for example, PHP 5.6.40 remains PHP 5.6.40. The package revision, shown after the hyphen, changes to identify the new package release containing the fixes. This is not a new PHP minor version.
For more recent branches, the PHP patch version also changes: for example, PHP 8.2 moves to 8.2.35. In every case, this work preserves the PHP branch selected for each website.
Installed versions and fixed packages
The table below covers all PHP branches found on our infrastructure after the deployment on 21 October 2026. Their changelogs explicitly list the fixes for CVE-2026-109618 and CVE-2026-109619.
| PHP branch | Installed PHP version | Fixed Sury package (abbreviated) |
|---|---|---|
| PHP 5.6 | 5.6.40 |
5.6.40-104… |
| PHP 7.0 | 7.0.33 |
7.0.33-92… |
| PHP 7.1 | 7.1.33 |
7.1.33-80… |
| PHP 7.2 | 7.2.34 |
7.2.34-66… |
| PHP 7.3 | 7.3.33 |
7.3.33-35… |
| PHP 7.4 | 7.4.33 |
7.4.33-31… |
| PHP 8.0 | 8.0.30 |
8.0.30-25… |
| PHP 8.1 | 8.1.34 |
8.1.34-9… |
| PHP 8.2 | 8.2.35 |
8.2.35-1… |
| PHP 8.3 | 8.3.36 |
8.3.36-1… |
| PHP 8.4 | 8.4.27 |
8.4.27-1… |
| PHP 8.5 | 8.5.12 |
8.5.12-1… |
Package names are abbreviated: the full suffix includes details such as the build date and the Debian distribution. The Debian technical prefix 1:, used by some packages, is also omitted from the table.
A tool showing only “PHP 5.6.40” or “PHP 7.4.33” therefore cannot establish whether these fixes are installed: the full package revision must also be checked.
These backports do not restore official support for older branches by the PHP project. They protect against the vulnerabilities addressed by the fixes; moving to an officially maintained PHP branch remains advisable.