Joomstore is aware of two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, publicly disclosed on 21 October 2026. Either one allows an attacker to execute arbitrary code on a server running PHP, potentially resulting in full compromise of the affected system. Proof-of-concept exploit code is publicly available, and there are no complete mitigations except patching. Updating PHP to a patched version is the only safe path to protection.
PHP powers a significant share of the web, including most of the web applications built and maintained by Joomstore, and technologies like Joomla, WordPress, Drupal, Laravel and custom applications deployed worldwide.
We are notifying all Joomstore customers that we have backported the security patches for PHP on our servers and tech stack. Our server and hosting platform are safe, and so are the websites hosted on it. However, for non-managed services and your other infrastructure, this issue warrants taking action to make sure you are safe.
Who is affected
These vulnerabilities affect every PHP version from PHP 5 onward. If you run PHP anywhere in your web infrastructure, consider yourself potentially in scope until you’ve patched. That includes cPanel hosting, VPS and cloud servers (such as DigitalOcean Droplets and AWS), app platforms and custom containers, LAMP and LEMP stacks, and previously deployed CMS websites, including but not limited to Joomla, WordPress and Laravel.
Patched PHP versions
The PHP project has released fixes for the following versions:
| PHP branch | Patched version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 or earlier | No patch available |
Patches are only available for currently supported PHP versions (8.2 and later). If you’re running an end-of-life version (8.1 or earlier), no official patch will be available. Plan an immediate upgrade to a supported version.
Need a hand?
If you’re not sure which PHP version your website or server is running, or you need help upgrading, give us a ring on 1300 566 652 or email [email protected] and we will check it for you.
