Critical PHP vulnerabilities: patched less than 30 minutes

Blog
Frank

21.10.2026

0 Comments

🛡️ Critical PHP vulnerabilities: patched less than 30 minutes after the release

Website and customer panel after 14 minutes, webspace servers after 27 minutes: how we responded to the PHP updates of 21 October.

When vulnerabilities surface, response time matters! ⚡️ On 21 October 2026, the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Under certain conditions, they could let an attacker remotely run their own code on a web server that uses PHP. This is not a ZAP-Hosting issue: PHP powers a large part of the web, so the vulnerabilities affect websites and web servers across the entire hosting industry.

🔎 What we know

Type: remote code execution, meaning foreign code can be run on the server through a crafted request.
Fixed in: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
No fix: PHP 8.1 and older no longer receive security updates from the PHP project and will not get a fix for these vulnerabilities.

⏱️ Before the release: prepared and protected

The release of the updates was announced in advance. Our infrastructure team used that time to map the systems that run PHP, from our website and customer panel to webspace servers, the phpMyAdmin interfaces of our database products and internal services. Until the release, we applied temporary protective settings and added filter rules at the edge of our network. That way, the known attack path was already restricted before the fix was out.

🚀 Release day: patched in under 30 minutes

Because everything was prepared, things moved fast after the release: our website and customer panel were running the new version within about 15 minutes, and our webspace servers within half an hour. Even under time pressure, we went step by step and tested every change first. Our remaining systems followed the same day.

🌐 Webspace: we took care of it

Webspaces that were still using PHP 7.4, 8.0 or 8.1 have been moved to PHP 8.2, because these old versions will not get a fix. We announced this as a service news in the customer panel and by email. Most websites keep running without any changes. If your application needs adjustments for the newer PHP version, our support team is happy to help.

🔧 Running your own VPS, dedicated server or self-hosted setup? Update it yourself

Our updates cover the services we manage for you. On your own VPS, dedicated server or any other self-hosted system, you are responsible for the installed software yourself, whether it runs with us, with another provider or at home. If PHP runs anywhere in your setup, for example for a website, a forum, a panel or inside a Docker container, please check it now:

Check which PHP version your server is running. The fixed versions are 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.
Install the updates yourself through your operating system's package manager.
Docker containers with PHP: pull or rebuild current images and recreate the containers. Updating the host system does not update PHP inside a container.
Restart PHP-FPM or your web server afterwards, so the running processes actually use the new version.
Still on PHP 8.1 or older? Plan an upgrade to a supported version. These versions will not receive a fix.

🛡️ Security never stops

This is not an isolated case. In August, we patched our KVM infrastructure against Zapscape and Januscape, two vulnerabilities that could allow a virtual machine to escape its isolation under certain conditions. Each time, the same principle applies: assess quickly, protect immediately and patch as soon as a stable fix is available. Security research never stops, and neither does our work behind keeping your services secure.