I just checked all my servers and the installed containers and the minimal setup I use has paid of once again. No PHP anywhere. So I can relax and stick to my weekly update schedule. Sending sysadmin hugs to all folks out there dealing with getting the PHP updates installed and working :(
0 Boosts
0 Likes
I will not link to sources and you don't have to trust me, but there are already exploits out there, one of them will get you a shell on servers running WordPress. So this is a critical update. CVE-2026-109618 and CVE-2026-109619 seem to affect all PHP versions going back to 5.4 and could result in RCE (Remote Code Execution).
And I also want to say "Don't panic". The details are still sketchy, there is tons of shitposting and doomsday posts. The updates are coming. Just make sure you get them installed. I am also sure we will get good information on how to limit the risk for those PHP versions that are not getting updates but are still being used.
But if you read https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/ and decide to take your servers offline until the patch is installed and working, that's not a bad idea. Better safe than sorry.
@jwildeboer @homelab just got an email from one of my savings providers that I can't update my 1 year ISA maturity instruction (the ISA matures on the 28th) at the moment. They'll let me know when I can.
Clearly someone is playing safe.
@jwildeboer Running a PHP hosting business. Interesting day for me.
@jorijn If you can and are allowed to — would be interesting to get a post-mortem on how this affected you and and your business. My guess is that the impact will be limited. But some forgotten/hidden PHP in 3rd party stacks or containers at places with less prepared admins will get hit :(
@jwildeboer @homelab I started the day with shutting down everything webfacing on my server out of an abundance of caution, then restarting everything that doesn't employ php.. My Nextcloud & Wordpress instances are still down, pending the update