Security alert: urgent PHP update required

Published on 21 October 2026

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed. They can allow unauthenticated remote code execution on affected servers. The PHP team has released security updates and strongly recommends updating immediately.

Action underway at TurboHost

On TurboHost hosting servers, we are already updating packages and applying mitigation measures. This work is in progress.

Guidance for VPS and dedicated server customers

If your VPS or dedicated server runs PHP, the server administrator should:

• Update all PHP installations to a fixed release: 8.2.35, 8.3.36 or 8.4.27, or 8.5.12, or a later release in the corresponding branch.

• If using distribution packages, confirm that they include fixes for both vulnerabilities.

• Check all PHP versions used by websites, control panels and containers.

• Restart affected services to activate the fixes.

• Confirm that websites are using the updated PHP installation and check that applications work correctly.

If you use PHP 8.1 or earlier, confirm whether security fixes are available for your packages or arrange an upgrade to a supported version.

Updates to hosting servers do not automatically update VPS or dedicated servers. If you administer your server, apply these measures. If you have a managed service, confirm the update with the team responsible for its administration.

If you cannot update immediately

Temporarily restrict access to affected applications where possible, and follow the mitigation guidance published by the PHP team.

Mitigations do not provide complete protection and do not replace updating. Updating WordPress, plugins or themes alone does not fix the PHP installation on your server.

Read the official PHP security advisory for technical details and mitigation guidance.

The TurboHost Team