The PHP security updates have now been deployed for PHP versions 7.3 to 8.1 as well. Some mitigations/restrictions will remain in place until it has been fully validated.
Posted Oct 21, 2026 - 23:10 CEST
Update
PHP security updates have been deployed for PHP versions 8.2 to 8.5. We are still working to get fixes out for customers on legacy versions.
Posted Oct 21, 2026 - 17:30 CEST
Update
The PHP development team has released security updates addressing the two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
These vulnerabilities affect PHP's internal memory and request handling and could potentially allow unauthenticated attackers to execute code on affected servers.
The security fixes are included in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
We have already implemented temporary security mitigations to reduce exposure and are now actively rolling out the patched PHP versions across the Servebolt infrastructure.
Our engineering team is closely monitoring the deployment and will provide further updates as the rollout progresses.
Posted Oct 21, 2026 - 16:58 CEST
Monitoring
We are aware of a major PHP security issue without a published upstream fix. Curently known mitigations have been enabled and the full patch will be deployed as soon as it is available.