Critical PHP vulnerabilities. We update PHP and keep your site running
Two flaws let an unauthenticated attacker run code on the server. Sites on PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. Workarounds help only partly — an update is required.
CVE-2026-109618CVE-2026-109619CVSS 9.2
Releases with the 21 Oct 2026 fixes8.2.358.3.368.4.278.5.128.1 and older — no official updates
1Audit and backup
2PHP and module update
3Code and CMS fixes
4Forms and integrations check
from ₽7,700 · one-off job · scope and timing agreed upfront