If your WordPress website is hosted on Fuze7-managed servers, your website is now patched. And here’s what happened.

On October 21, 2026, PHP released security updates addressing two critical vulnerabilities. If your website is hosted on servers managed by Fuze7, these vulnerabilities have already been patched. No action is needed on your end.

Here’s what happened and what it means for your website.

What Happened?

On Tuesday, the PHP security team published an advance notice of an upcoming security release, scheduled for Wednesday, October 21. This advance notice gave hosting providers and security teams time to prepare for the updates.

Right on schedule, PHP released patched versions for its current runtime versions. The coordinated security release addressed two critical vulnerabilities, both rated CVSS v4.0 9.2 and both capable of unauthenticated remote code execution (RCE).

  • CVE-2026-109618 — RCE via out-of-memory corruption. Out-of-memory handling can interrupt PHP while internal request data is only partially initialized, potentially causing request cleanup to treat invalid data as valid.
  • CVE-2026-109619 — RCE via stale global state. Internal state associated with a request can persist after its backing memory has been freed, potentially allowing a later request to use stale state before initialization resets it.

The PHP project confirmed that there are no complete workarounds for these vulnerabilities. Configuration changes may reduce some attack paths, but updating to a patched version is the only effective fix.

That’s why applying security updates promptly is essential. The vulnerabilities have been patched on the Fuze7-managed servers that we maintain.

What This Means for Your Website

  • The vulnerabilities have been patched. Websites running on Fuze7-managed servers are protected by the applicable security updates.
  • No action is needed from you. The updates have already been applied to the servers we manage.
  • Security remains a priority. We continue to monitor relevant updates and apply security patches to help keep hosted websites protected.

 

One additional item worth noting: PHP 8.2 reaches end of life on December 31, 2026. If your website or application still relies on PHP 8.2, now is a good time to plan an upgrade to a supported version.

Keeping your website’s software up to date is key to maintaining its security, stability, and performance.

Have questions about your website’s PHP version or security? Contact the Fuze7 team, and we’ll be happy to help.

Stay secure, and stay up to date!