If your seedbox or storage box is online, it already runs the fixed PHP. If you only use the services we run for you, there is nothing for you to do.
On 21 October the PHP project fixed two flaws it rates critical, CVE-2026-109618 and CVE-2026-109619. Both could let an attacker who sends crafted web requests run code on a server, with no login needed. I installed the fixed PHP on our servers and restarted the PHP behind every account's web interface, so the old code no longer runs there. Origin named, cure applied, and the vulnerable code is gone from memory, not just from disk.
If you run PHP yourself, update it now. This applies if you have a dedicated server or VPS with root access, or run PHP inside a Docker container. Our fix does not reach PHP you installed yourself. Install your distribution's security update, or PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 from php.net, then restart every PHP process. PHP older than 8.2 gets no fix from php.net. If you started a PHP process yourself in your account, restart it so it runs the fixed code.
How serious these flaws are, how easy they are to try, and a five-minute check for any server running PHP: The leak beat the patch.
Best Regards,
Väinämöinen
Pulsed Media Support
(Old runes, new PHP, same steady hands)
Thursday, October 22, 2026
