We are aware of two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both have been rated 9.2 (Critical) on the CVSS v4.0 scale by the PHP security team. We are monitoring the situation closely.
Is Centrilogic impacted?
No. Our investigation shows that Centrilogic’s platforms, infrastructure and managed service tooling do not run affected PHP components and are not impacted. No customer action is required for services we operate. We will update this notice if those changes.
What we know:
PHP announced an out-of-cycle security release for October 21, 2026, at 14:00 UTC (10:00 EST), after details of the flaws leaked ahead of the planned disclosure. Third-party reporting suggests a very wide range of PHP versions (PHP 5.x and later) may be affected. PHP has not yet confirmed affected versions, root cause or exploitation conditions. As of this posting, no exploitation in the wild has been publicly reported. Customers running their own PHP workloads, Websites, web applications, CMS platforms (e.g., WordPress, Drupal, Magento) and hosting panels that use PHP may be affected, depending on version.
How to check whether you are exposed:
Identify PHP versions on your servers. Run php -v for the command line or check your package manager (dpkg -l | grep php or rpm -qa | grep php). The version used by your web server can differ from the command line version. Confirm it with a phpinfo() page or ask your hosting provider. Check containers, hosting control panels and third-party applications that bundle their own PHP. PHP 8.1 and earlier are end of life and may not receive a fix. Plan to upgrade to a supported version.
Patch information:
Apply the fixed PHP releases published on https://www.php.net/, or the updated packages from your OS or distribution vendor. If you use a managed or shared host, confirm with the provider that they are patching. Until you can patch, restrict public exposure of PHP applications where possible. Also watch for PHP or web server processes unexpectedly launching shells or download tools, which could indicate compromise.
For any issues, please contact support through your usual channels. We remain committed to supporting you throughout this. Thank you for your understanding.