I critical update to PHP has been discovered and logged under CVE-2026-109618 and CVE-2026-109619. This vulnerability is a significantly serious one that can allow an attacker to execute code and potentially also gain access to your site.
We can confirm that all of our servers have already been patched and verified to be secure and are not susceptible to this exploit.
Please see https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php for further details on the exploit.
Wednesday, October 21, 2026
