Critical PHP Vulnerabilities: How VAON Responded, and Update Support Now Available

At around 23:00 Japan time on 21 October 2026, the PHP project released fixes for two high-severity vulnerabilities (CVE-2026-109618 and CVE-2026-109619). For the five systems VAON maintains for customers, the team started updating as soon as the fixes were out. The PHP update itself took about an hour; each system was then retested in full.

What we did that night

While work was under way, a maintenance page was served from the web server and load balancer configuration, so no request reached PHP. An application's built-in maintenance mode still runs on PHP, so it does not protect against these vulnerabilities.

For each system, the team then confirmed the server setup and where PHP was installed from before updating to the fixed release. The PHP version a command reports can differ from the PHP that actually serves the website, so both were checked.

Most of the time went into what came after the update: working out which libraries, at which versions, could break on the new PHP, and then retesting the whole system. The work and its results are being reported to each system's contact.

Background

The PHP project rates both vulnerabilities 9.2 under CVSS v4.0 and states that there are no complete mitigations and updating is the only safe choice. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. IPA, Japan's Information-technology Promotion Agency, issued an alert on 22 October that refers to the pair as "PHP2Shell". PHP 8.1 and older receive no fix this time, and PHP 8.2 reaches end of life on 31 December 2026.

What it means if your company runs PHP

Any site or system running on PHP, WordPress included, may be affected. We suggest asking your web developer or maintenance provider:

• Which PHP version you run, and whether it has been updated to the fixed release
• If it cannot be updated right away, what interim measures are in place, and if it runs PHP 8.1 or older, when it will be migrated

If you do not know who to ask, or have no one in-house who handles this, VAON can help through its PHP Emergency Update and Impact Diagnosis service. The service covers diagnosing your PHP version and how PHP runs, updating to the fixed release, and checking that everything works afterwards. We quote the cost before any work starts, once we understand your environment.

Contact

Send us your site URL and, as far as you know, the type of server it runs on.

Contact: https://vaon.com.vn/en/contact
Urgent: luan.dang@vaon.com.vn

References

• PHP: PHP security advisory, 21 October 2026 (php.net)
• IPA: Alert of 22 October 2026 (ipa.go.jp)