On 21 October 2026, Contabo emailed me about two critical PHP vulnerabilities. On an unmanaged VPS, the alert is the starting point: the server owner still has to apply and verify the fix.
What changed?
PHP released fixes for CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Check your distribution’s advisory if it supplies backported fixes.
What I did
I checked the running WordPress containers and found PHP 8.3.33. After validating the database and file backup archives, I rebuilt the custom image using the updated base and recreated both the web and scheduled-task containers. Both now report PHP 8.3.36; the web container is healthy and the store returns HTTP 200.
The simplest safe sequence
- Identify the PHP runtime actually serving your site.
- Back up the database and files, then obtain the vendor’s patched package or image.
- Update the runtime. For Docker, rebuild custom images and recreate the affected containers; pulling an image alone is not enough.
- Verify the web runtime and background workers, then test important application flows.
What to expect
The patch addresses these two vulnerabilities. It does not prove that no earlier compromise occurred, and a successful homepage response is not a complete checkout test. Continue reviewing logs and application behaviour.
Source: PHP security advisory, 21 October 2026. Operational checks: 22 October 2026, Saudi time.