Thoughts on the PHP security updates of 21 October 2026

Our company works with mature open-source technologies that anyone can review and audit, and we constantly care about the security and operational continuity of the applications we deliver to our clients. However, these technologies are far from free of errors, which is why we dedicate time and resources to addressing security updates in the technologies we use.

On October 21, 2026, emergency patches were released for two critical vulnerabilities in PHP, corresponding to security advisories CVE-2026-109618 and CVE-2026-109619. CVE stands for “Common Vulnerabilities and Exposures,” a catalog of publicly known security vulnerabilities in software applications and hardware components.

We became aware of this information at 11:40 a.m. on Wednesday, and immediately issued a notice to all our clients about the risk it posed. We took the following measures, at approximate times:

11:45 CLST / 14:45 UTC: Mass update of PHP and other tools on all public servers that hold our clients’ information and are under our control. On Rocky Linux servers we updated to PHP 8.5.12, and on Ubuntu Linux servers to 8.5.4-0ubuntu1.5.

12:00 CLST / 15:00 UTC: Restart of all public servers that hold our clients’ information and are under our control, with a service interruption of 15 minutes.

15:00 CLST / 18:00 UTC: The investigation of all application logs, collected from our monitoring services, began and concluded on October 30, 2026, finding no indication of security problems.

Service interruptions totaled 30 minutes: 15 minutes for the PHP update and 15 minutes for the application update.

The platforms we develop operate behind a Web Application Firewall that admits only a valid data set for each site, which reduces the attack surface. However, the primary protection against this type of security flaw is the software update, which has been applied 100%. We also apply security updates to the applications running on PHP, with a calculated downtime of 15 minutes. This update is performed periodically and automatically, but we have the means to perform it manually and verify the results.

Only one service remained unavailable longer than necessary, because the organization that manages it has its own information retention policies. Nevertheless, the audit performed on this service also found no successful exploitation attempts.

Our company remains committed to developing excellent products and services for our clients. For any questions, please do not hesitate to contact us through our institutional channels.