TL;DR: PHP has disclosed two critical security vulnerabilities, each rated 9.2 out of 10. Seven of the platforms we offer through our Managed Hosting run on PHP. We’ve already taken snapshots of every affected instance, and today, 21.10.2026 at 17.00 CEST (Berlin/Rome timezone), we’re updating them all to PHP 8.3.36, the latest 8.3 release, which includes the fixes. You don’t need to do anything on your side. There may be a short interruption during the maintenance window.
What happened
On Tuesday (20.10.2026), the PHP security team gave advance notice of an emergency security release covering two critical vulnerabilities. Both are rated 9.2 out of 10 on the CVSS v4.0 scale, which is the standard way of measuring how serious a security flaw is. The fixed versions came out today (21.10.2026): PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. In plain terms, both come from how PHP manages memory while it handles web requests:
- the first can be triggered when PHP runs out of memory partway through a request and then cleans up data that was only half set up;
- the second allows leftover data from an earlier request to stick around in memory and get reused by the next one.
In the worst case, either of these could let an attacker run their own code on a server without needing to log in. PHP considers every installation that serves web requests to be at risk. Right now, we aren’t aware of any confirmed attacks to our infrastructure using these vulnerabilities. However, at the time this blog post is being written we continue to further examine our tech stack to make sure this is still not the case.
How we are responding
The moment we got informed about this specific vulnerability, our team started working on evaluating the potential impact of this security issue right away and planning the next steps ahead, which we mention below.
Which platforms are affected
Based on that review, these platforms from our Managed Hosting catalog run on PHP and are affected:
The following platforms are not affected, because they aren’t built on PHP: Video Chat (BigBlueButton), Discourse, Funkwhale, Ghost, GitLab, Mastodon, Matrix, Mattermost, PeerTube, Vaultwarden, WriteFreely and Zammad. These instances aren’t part of today’s maintenance and will keep receiving their regular updates as per our policy.
Our action plan
1. Snapshots first (done). Following our internal protocols, the first thing we did was take snapshots of all affected instances. A snapshot is a complete copy of your instance at a specific point in time. If anything unexpected happens during the update, we can quickly roll back to a known working state, with no data lost.
2. Updating PHP (today, 21.10.2026 at [TIME] CEST, Berlin/Rome timezone). We’ll update PHP on every affected instance and make sure the latest 8.3 release, PHP 8.3.36, is installed. This version contains the fixes for both vulnerabilities.
3. Checking everything afterwards. Once the update is done, we’ll confirm that each instance is actually running the new PHP version. We’ll also test that the key features of each platform still work, such as logging in, uploading files and scheduled background tasks. We’ll then keep a closer eye on our logs and monitoring over the following days.
What to expect during the maintenance
While PHP restarts on each instance, you may notice brief interruptions, such as a page that won’t load or a sync that pauses for a moment. We recommend saving any open work before [TIME] CEST. If something still isn’t working after the maintenance window has ended, please let us know.
Do you need to do anything?
No. Handling this kind of update is exactly what our Managed Hosting services are for.
There’s one exception. If your team also runs PHP-based websites or tools somewhere else (outside Cloud68.co services), for example on your own server or with another hosting provider, check that they’ve been updated to one of the fixed versions (8.5.12, 8.4.27, 8.3.36 or 8.2.35). PHP 8.1 and older versions no longer receive official updates, so if you’re still running one of them, now is a good time to plan an upgrade.
Status updates
We’ll keep this section updated as the work progresses:
- 21.10.2026, [13:00]: Review of affected instances completed
- 21.10.2026, [14:00]: Snapshots of all affected instances taken
- 21.10.2026, [17:00]: Maintenance has started
- 21.10.2026, [TIME TBA]: Maintenance completed, all affected instances running PHP 8.3.36
Further reading
Human support
If you have questions or concerns, or notice anything unusual after the update, open a ticket. Our support hours are Monday to Friday, 09:00–17:00 Berlin/Rome timezome. During this maintenance, our infrastructure team will be keeping an eye on things beyond those hours as well.
