PHP flaw CVE-2026-109618: our clients protected before the fix even existed

On Tuesday 21 October 2026, two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10, went public. They let a stranger take over a server, with no password, through a plain file-upload request. WordPress, Magento, Drupal, PrestaShop, Symfony, Laravel: every PHP application was exposed. The first attacks started that same morning, before any fix existed.

Protected before the fix existed

On the morning of 21 October, our engineers shut down the feature the attack goes through on every PHP we run, whatever its version and operating system. Our clients were protected hours before the official fix existed.

That same day, as soon as it shipped, we installed the official fix. The next morning, older PHP versions, which upstream no longer patches, were fixed too.

The result: the flaw is fixed or neutralised on every server we run, across all versions and operating systems. No site was hacked. Our clients’ sites stayed online throughout.

Every client concerned was kept informed in real time through their support ticket. None had to lift a finger.

Why we can move this fast

It is not luck. It is what we have done every day since 2003: a senior team that knows every server, 24/7 monitoring and an on-call team reachable at night and on weekends.

A flaw like this one plays out in hours. Between its release and the update of every server, an exposed application can be taken over, its data stolen, its business stopped. Our clients never had to ask the question.

Is your platform covered?

• Managed infrastructure: we keep your servers updated, monitored and protected, 24/7.
• Application maintenance: still running an old PHP? We move your application to a supported version and keep it up to date.
• Web Application Firewall (WAF): it blocks attacks in front of your site while the fix rolls out.
• Cybersecurity: audit, hardening and incident response.

Not sure where you stand? Talk to us and we will tell you.