Critical PHP Security Advisory: What Dotsquares Is Doing to Protect Your Platform

On 21 October 2026 the PHP development team issued a security advisory highlighting two critical vulnerabilities. Both receive a CVSS 4.0 score of 9.2 (Critical) and stem from potential remote code execution issues that could result in unauthorised code execution on an affected server.

If your website or application runs on PHP, and if that includes platforms like WordPress, Magento and Laravel, then these vulnerabilities are relevant to your environment. As part of our maintenance and support agreements we are already working through the assessment and remediation process for clients under contract. This post explains what is happening, what we are doing, and what you can expect from us.

What Are the Vulnerabilities?

CVE-2026-109618 - Remote Code Execution (CVSS 9.2 / Critical)

A memory-management flaw that involves stale internal application state. Like the first it creates a pathway for an attacker to execute code, remotely, on a vulnerable server. Both of these affect PHP installations that handle web requests, including PHP-FPM and PHP-CGI configurations.

CVE-2026-109619 - Remote Code Execution (CVSS 9.2 / Critical)

A memory-management flaw that involves stale internal application state. Like the first it creates a pathway for an attacker to execute code, remotely, on a vulnerable server. Both of these affect PHP installations that handle web requests, including PHP-FPM and PHP-CGI configurations.

Why This Needs Immediate Attention

Remote code execution vulnerabilities at this level are a serious concern because exploitation doesn't require access credentials; an attacker can target a server via the web without needing to log in or gain access to the system themselves.

If a server running a vulnerable PHP version is successfully exploited, the potential impact includes:

• Unauthorised code execution on the server
• Compromise of the website, application, or the underlying server environment
• Exposure, alteration or loss of business and customer data
• Service disruption, downtime and the reputational fallout that follows

The PHP development team has been clear on this: updating to a fixed version is the only complete remediation. Temporary security controls, firewall rules, and WAF configuration can reduce exposure but should not be treated as a substitute for patching.

Affected environments: PHP installations handling web requests, including PHP-FPM and PHP-CGI. Platforms built on PHP, including WordPress, Magento, Laravel and other PHP-based frameworks, may be affected depending on the PHP version in use.

What Dotsquares Is Doing

For clients under an active maintenance or support agreement with us, our team is working through the following for each applicable environment:

• Reviewing the PHP versions in use across your website or application environment
• Identifying whether your environment is running a vulnerable version and what the appropriate security update is
• Checking application compatibility before applying any patch, this step matters for older applications or custom builds that may have dependencies on specific PHP versions
• Applying the relevant security update, restarting services where required, and confirming the updated version is active
• Communicating any compatibility issues, legacy version constraints, or cases where additional work is required beyond a simple patch

We'll keep you updated on any findings, actions, and remaining risk factors exclusive to your environment. For any work that falls outside the scope of your existing agreements, we'll bring it to your attention beforehand to discuss potential options or next steps. If your application needs more than a routine security patch, our PHP development services can help address legacy code issues, resolve compatibility problems, and plan the upgrades needed to keep your PHP application secure and reliable.

A note on legacy versions: Certain legacy applications tend to be bound to PHP versions no longer patched for security by the PHP development team. In the event it applies to your environment, we'll note it for your review and discuss what would be the optimal upgrade path tested for compatibility (or otherwise) for your particular case.

What You Should Do

If you are under a Dotsquares maintenance or support agreement, we are already on this. You do not need to take any action independently, but if you have questions, concerns about a specific part of your environment, or need an update on where things stand, get in touch with your account contact or reach out through the usual support channels.

For environments that fall outside the scope of your agreements, staging servers, separately hosted applications, or otherwise managed elsewhere - this is the time to check their PHP version and make sure they're on a fixed release.

Questions about your particular environment or the remediation steps? Get in touch with your account contact or reach out to the Dotsquares support team directly.

Contact Dotsquares