Critical PHP Vulnerabilities
Important information for Iperium Partners and Customers
Security Incident: PHP Vulnerability
(CVE-2026-109618 and CVE-2026-109619)
Iperium wishes to advise our partners and customers of two critical PHP security vulnerabilities recently disclosed by the PHP project, potentially affecting web hosting environments, websites and applications worldwide.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow unauthenticated attackers to remotely execute malicious code on vulnerable PHP installations.
If successfully exploited, these vulnerabilities could result in unauthorised access, compromise of hosted websites and applications, and potential disruption to affected services.
The PHP project released security updates on 21 October 2026 to address these vulnerabilities.
What systems may be affected?
The vulnerabilities may affect a range of PHP-based technologies, including:
- ✅ Web Servers: PHP-FPM, Apache with mod_php and php-cgi.
- ✅ Content Management Systems: WordPress, Drupal, Joomla and other PHP-based website platforms.
- ✅ Web Applications: Custom-built PHP applications, customer portals and business systems.
- ✅ Network Infrastructure: Routers, firewalls and other devices operating PHP-based web management interfaces.
Organisations operating PHP-based services should review their environments and identify any systems requiring security updates.
Recommended Actions
The PHP project has released security fixes for supported PHP versions 8.2 through 8.5.
Iperium strongly recommends that customers and partners operating their own PHP environments take the following precautions:
- ✅ Apply PHP Security Updates
Update affected PHP installations to the latest available patched version. Ensure all relevant security patches have been successfully deployed.
- ✅ Review Website & Application Compatibility
Check that websites, content management systems, plugins and custom applications remain compatible with the updated PHP version.
- ✅ Assess Independently Managed Infrastructure
Review any independently managed web servers, applications, routers, firewalls or network devices that may use PHP.
- ✅ Monitor for Unusual Activity
Review server logs, website access records and application activity for indications of suspicious or unauthorised access.
- ✅ Review Unsupported PHP Versions
PHP 8.1 and earlier are no longer supported by the PHP project. Organisations using these versions should prioritise migration to supported releases or seek verified security fixes from their infrastructure vendors.
What is Iperium Doing?
Proactive, Not Reactive.
At Iperium, the security and reliability of our infrastructure remain a priority.
Our technical team has been proactively maintaining and updating our PHP hosting environments as part of our ongoing infrastructure security practices.
Following the latest security disclosure, our team has been reviewing the relevant advisories and deploying applicable security updates across our managed hosting infrastructure.
These measures form part of our commitment to maintaining secure, reliable hosting environments and reducing potential risks for our partners and customers.
We will continue monitoring developments, reviewing emerging threats and implementing additional security measures where required.
What Does This Mean for Iperium Customers?
Customers using Iperium managed hosting services can be assured that our technical team is actively addressing the latest PHP security advisories.
For customers operating independently managed PHP environments or applications, we recommend reviewing your systems and applying the appropriate security updates without delay.
While Iperium maintains the security of its managed infrastructure, customers remain responsible for maintaining their independently managed websites, applications, plugins and other software unless covered by an applicable managed service agreement.
Further Information & Support
For technical information on these vulnerabilities, including available security updates and recommendations, please refer to the official PHP project resources:
Official PHP Website: https://www.php.net/
PHP Supported Versions: PHP: Supported Versions
If you have questions regarding your Iperium web hosting environment or require further assistance, please contact our support team through your usual support channels.
Our Commitment to Security
At Iperium, we take the security and reliability of our infrastructure seriously. Protecting our partners, their customers and the services they depend on remains a priority.
We are committed to:
Taking proactive action to identify and address potential security vulnerabilities.
Maintaining secure infrastructure through regular updates, security patching and ongoing monitoring.
Keeping our partners informed with timely, transparent communication about emerging security threats.
Continuously strengthening our security measures to minimise risks and maintain reliable hosting services.
Our technical team will continue monitoring developments surrounding the recently disclosed PHP vulnerabilities and implementing any additional measures required.
Your customers rely on you. You can rely on us.
— The Iperium Team