omnexa.

URGENT · ADVISORY · 21 OCTOBER 2026

Critical PHP update.
Check your site for free now

TAKE ACTION NOW

Check. Update. Confirm.

  1. Find your PHP sites. Include those your host manages.
  2. Update the running package. Ask your host to apply both fixes.
  3. Confirm it is live. Restart PHP workers if needed.

Patched PHP versions

8.5.12 · 8.4.27
8.3.36 · 8.2.35

These versions or later in the same branch. Vendor backports may also include both fixes.

Flaw details & older versions

CVE-2026-109618 and CVE-2026-109619: both rated 9.2 (CVSS v4.0). They can allow unauthenticated remote code execution.

PHP 8.1 or older: ask your host about backports or upgrading. A public version header alone cannot confirm the fix.

THE OMNEXA PHP UPDATE CHECK

Know your sites are patched.

  1. FindList your PHP websites and servers.
  2. ConfirmIdentify the running PHP packages.
  3. FixHelp your host apply the fixes.
  4. VerifyConfirm the fix is live, with a written record.

With your written permission. Agreed scope. Human-reviewed results.

Want us to handle it?

Email Omnexa

Sources: php.net release notes, 21 October 2026 · CISA alert, 21 October 2026