In October 2026, two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been announced by the PHP Foundation.
In October 2026, two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been announced by the PHP Foundation. The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers.
Introduction
These vulnerabilities affected all PHP versions from PHP 5, which practically means that almost all (if not all) currently used PHP versions could be used to remotely execute a command in the shell. More details e.g. here, here or here.
How it affects Hubleto servers
All Hubleto servers run on PHP 8.5. This version of PHP received a patch on October 21 at 4PM a security patches that fix these vulnerabilities.
Immediately after releasing these patches, we have upgraded all servers to use the lastest PHP versions. This update prevents from penetrating our servers by using this vulnerability.
(source: www.pixabay.com, www.freepik.com, Google Gemini)
Conclusion
We steadily keep updating Hubleto codebase to be compatible with the latest versions of PHP. Thanks to this, the fix for these critical vulnerabilities was easy and fast.