PHP security alert: updates and migration to PHP 8.5

What is confirmed as of 21 October 2026

Status: 21 October 2026, 12:40 CEST. PHP has announced a security release for 16:00 CEST (14:00 UTC), addressing two critical vulnerabilities rated CVSS v4.0 9.2 each. Affected and fixed versions are due with the release. At the time of this check, the advance notice did not identify specific patched versions.

CloudLinux lists the reported pre-disclosure identifiers CVE-2026-109618 and CVE-2026-109619. PHP does not yet name them in its advance notice. We do not infer a complete affected-version list or confirmed patched versions from this.

CloudLinux already reports matching attack attempts and describes WAF rules as a temporary, partial mitigation. Such measures do not replace patching. Check vendor guidance to establish which interim measure suits your installation.

What you can prepare now

• Take inventory: which websites, subdomains, stores, APIs and background jobs use PHP? Record the version, package source and responsible person for each application.
• Check web and background processes separately: the PHP version selected in the hosting panel may differ from the version used by scheduled jobs or queue workers. A command-line version check alone does not establish the website's runtime.
• Establish the update route: who provides packages or container images, who installs them and who verifies the result? For managed hosting, involve the responsible provider; for self-managed systems, follow vendor notices and package availability.
• Prepare recovery: back up files, databases and configuration, verify restoration and agree a maintenance window with reachable contacts.
• Act when fixes become available: promptly install the security update approved for your installation. Restart affected processes as instructed by the vendor, then verify the versions actually running and application behaviour.

Plan security patching and version migration separately

An urgent security update should not wait for a lengthy application upgrade. If your supported PHP branch receives a suitable fix, apply it as the immediate remediation path. Prepare a PHP 8.5 migration alongside that work. What matters is a confirmed fix in the deployed package; the label “PHP 8.5” alone does not establish that a system is patched.

For end-of-life PHP versions, establish whether a specific provider still supplies security fixes. Such extended coverage is separate from support by the PHP project. If a reliable fix is unavailable, work with the operator to assess temporarily restricting the affected application and moving to a supported environment. An old, unpatched installation is not a suitable long-term fallback.

Why PHP 8.5 is worth considering

PHP 8.5 is a stable release branch. The official support schedule lists active support until 31 December 2027 and security support until 31 December 2029. PHP 8.2 reaches the end of security support from the PHP project on 31 December 2026. This is another reason to assess older environments now.

Whether an application can run on PHP 8.5 depends on its dependencies. Check support for the CMS or store, plugins, themes, frameworks and required PHP extensions. If a component is not compatible yet, we help plan a supported interim solution. We do not force a migration by ignoring version requirements.

How we prepare the migration with you

• Assessment: document application versions, extensions, database connections, PHP configuration and background jobs. Identify required application upgrades and unresolved compatibility questions.
• Separate test environment: prepare a suitable copy on the intended, patched PHP 8.5 build. Restrict test access and prevent real payments or outbound customer messages.
• Check dependencies: for Composer projects, composer check-platform-reqs under the target runtime can identify unmet PHP or extension requirements. This supplements functional tests; it does not prove full compatibility on its own.
• Test business workflows: verify sign-in, forms, file uploads, search, baskets, order workflows, API integrations and scheduled tasks. Compare error logs and response times with the previous environment.
• Controlled cut-over: agree acceptance, a maintenance window, data synchronisation and rollback criteria. After switching, verify web processes, background jobs, monitoring and backups. Account for new data in any rollback.

NUXOA helps with updates and PHP 8.5 migrations

Running an older website, a store or several client projects? We help assess the technical state, plan the target environment and support testing and cut-over. If application code or extensions need changes, we coordinate them with you and the responsible developers. Scope, timing and costs are agreed for your environment.

For an initial assessment, provide the application and version, current PHP version, hosting panel or server environment and key extensions. Use the “Enquire about a PHP 8.5 migration” link below this article. Credentials and personal customer data are not needed for this first enquiry.