{"id":4,"date":"2026-10-22T02:19:30","date_gmt":"2026-10-21T23:19:30","guid":{"rendered":"https:\/\/drhmalanazi.com\/blog\/php-security-update-october-2026\/"},"modified":"2026-10-22T02:19:30","modified_gmt":"2026-10-21T23:19:30","slug":"php-security-update-october-2026","status":"publish","type":"post","link":"https:\/\/drhmalanazi.com\/blog\/en\/php-security-update-october-2026\/","title":{"rendered":"PHP security update: from Contabo’s alert to a verified deployment"},"content":{"rendered":"

On 21 October 2026, Contabo emailed me about two critical PHP vulnerabilities. On an unmanaged VPS, the alert is the starting point: the server owner still has to apply and verify the fix.<\/p>\n

What changed?<\/h2>\n

PHP released fixes for CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12<\/strong>. Check your distribution’s advisory if it supplies backported fixes.<\/p>\n

What I did<\/h2>\n

I checked the running WordPress containers and found PHP 8.3.33. After validating the database and file backup archives, I rebuilt the custom image using the updated base and recreated both the web and scheduled-task containers. Both now report PHP 8.3.36; the web container is healthy and the store returns HTTP 200.<\/p>\n

The simplest safe sequence<\/h2>\n
    \n
  1. Identify the PHP runtime actually serving your site.<\/li>\n
  2. Back up the database and files, then obtain the vendor’s patched package or image.<\/li>\n
  3. Update the runtime. For Docker, rebuild custom images and recreate the affected containers; pulling an image alone is not enough.<\/li>\n
  4. Verify the web runtime and background workers, then test important application flows.<\/li>\n<\/ol>\n

    What to expect<\/h2>\n

    The patch addresses these two vulnerabilities. It does not prove that no earlier compromise occurred, and a successful homepage response is not a complete checkout test. Continue reviewing logs and application behaviour.<\/p>\n

    Source:<\/strong> PHP security advisory, 21 October 2026<\/a>. Operational checks: 22 October 2026, Saudi time.<\/p>\n","protected":false},"excerpt":{"rendered":"

    How I updated WordPress containers after Contabo’s PHP alert, and why pulling a new Docker image is only the first step.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/drhmalanazi.com\/blog\/wp-json\/wp\/v2\/posts\/4","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/drhmalanazi.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/drhmalanazi.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/drhmalanazi.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/drhmalanazi.com\/blog\/wp-json\/wp\/v2\/comments?post=4"}],"version-history":[{"count":0,"href":"https:\/\/drhmalanazi.com\/blog\/wp-json\/wp\/v2\/posts\/4\/revisions"}],"wp:attachment":[{"href":"https:\/\/drhmalanazi.com\/blog\/wp-json\/wp\/v2\/media?parent=4"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/drhmalanazi.com\/blog\/wp-json\/wp\/v2\/categories?post=4"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/drhmalanazi.com\/blog\/wp-json\/wp\/v2\/tags?post=4"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}