Critical PHP Security Vulnerabilities (CVE-2026-109618 / CVE-2026-109619) →

Websites Created Before 1 September 2026 Websites Created From 1 September 2026

As you may be aware, two critical PHP security vulnerabilities have been announced by the PHP Security Team.

As of two weeks ago, all client websites are on PHP 8.5 owing to earlier optimisation of the web hosting stack I offer.

For the avoidance of doubt, this also includes websites created before 1 September 2026 (legacy), where I am still responsible for maintenance/updates and have access to cPanel.

PHP 8.5 is the latest supported version, and means all websites hosted by PatrickFound., or…