Security advisory: two critical PHP flaws require immediate upgrade to patched releases

Tripoli — On 21 October 2026, two critical vulnerabilities were disclosed in the core PHP runtime, affecting a wide range of PHP-based websites and applications, including common CMS platforms and hosting panels.

Tracked as CVE-2026-109618 and CVE-2026-109619, the issues are rated Critical (around CVSS 9.2). Official reports indicate they can enable unauthenticated remote code execution on exposed PHP workers.

Coordinated guidance is consistent: upgrading to a patched release is the complete fix. Temporary configuration controls are only partial mitigation.

Minimum safe releases Move immediately to one of the following builds, then restart PHP workers (php-fpm, Apache mod_php, or the container):

• PHP 8.5 → 8.5.12
• PHP 8.4 → 8.4.27
• PHP 8.3 → 8.3.36
• PHP 8.2 → 8.2.35

Branches 8.1 and older are end-of-life upstream and do not receive a routine upstream fix for these CVEs, so migration to a supported patched branch is required without delay.

Local relevance Many institutional sites, shops, and booking systems in Libya still run on PHP through common hosting stacks. A single internet-facing unpatched server can put data and service continuity at risk.

Median Group urges technical teams to confirm the active version with php -v, apply the update from their package source or container image, verify every worker is patched, and review multi-site hosts that share the same PHP binary.

median.ly itself is built on Next.js/Node.js rather than PHP at the application layer. This advisory is published because many customers and partners still operate PHP services alongside Median platforms.

Official sources - PHP news archive 2026 - PHP Foundation release note - CERT-EU 2026-018

For upgrade coordination linked to Median platforms: book an appointment · contact us.