Upcoming PHP security release for critical vulnerabilities CVE-2026-109618 and CVE-2026-109619
From https://news-web.php.net/php.announce/509
> We want to inform you of an upcoming PHP security release that addresses two critical vulnerabilities (both rated CVSS v4.0 9.2, Critical). The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. We encourage all PHP users to prepare now so you can update as soon as it is available. We reserve the right to release earlier if details of either vulnerability become public, or if we see evidence of active exploitation in the wild.
I see no posts from Upsun about this issue, or their timeline for resolving it in their PHP image, and what customers need to do (if anything) to ensure they are protected as soon as possible.
14
Comments
Hi
We are aware of and have taken action to mitigate the vulnerability. Further information will be released after the embargo has lifted.
I see the patches dropped. Are we good or is there something to do?
It seems that there is nothing to do: https://status.upsun.com/incidents/2cdvc2ctv5jwb
I'm not sure there's nothing to do. It says they're rolling out the images. I does also say they'll “refresh containers” but I would keep an eye on that for additional updates and make sure your sites are running on the updated release after they're finished.
Drupal.org is gone at the moment, so our patches are failing and we can't deploy anyway.
I noticed that two of our clients' projects went offline (could not upsun ssh in) for a while. I assumed that meant that those containers were being refreshed. But alas, I just got back in to both of them and they are still on PHP 8.3.35.
It would be really great if Upsun could help us provide some clarity around timeline and expectations to our clients.
Our fixed gen2 environments are not updated while the testing Grid ones are. A maintenance deployment and a manual full deployment were made but they remain at 8.4.16.
We've raised a ticket because it's not the first time that these envs are left behind.
I was seeing similar weirdness where environments didn't look updated but a second set of scheduled maintenance deploys happened and everything looks up to date.
I am wondering how I can tell if an older PHP version has been patched. Is there any way to tell for sure, from the PHP info page maybe?
Ok, the support says it is not visible on the status page, but is in the image version. 1424 or above is patched for PHP 8.1:
upsun app:config-get --property type -p [project_id]Please sign in to leave a comment.