{"id":4133,"date":"2026-10-22T12:44:06","date_gmt":"2026-10-22T12:44:06","guid":{"rendered":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/"},"modified":"2026-10-22T13:30:04","modified_gmt":"2026-10-22T13:30:04","slug":"critical-php-security-update-what-to-do","status":"publish","type":"post","link":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/","title":{"rendered":"Critical PHP Security Update: What You Must Do"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The PHP project released security updates on 21 October 2026 fixing two critical, unauthenticated remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). If you run a dedicated server or a self-managed (unmanaged) cloud\/VPS server with PHP installed, you are responsible for updating it yourself. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (whichever major version you run) as soon as possible. If you are on one of our fully managed plans, our team handles this for you, see the note below. Further down, there&#8217;s a single SSH command for your setup that checks your version and updates it in one step.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/10\/php-version-check.png\" alt=\"Terminal showing php -v output confirming PHP 8.3.36, the version that fixes the 21 October 2026 security advisory\"\/><figcaption class=\"wp-element-caption\">Checking your PHP version with <code>php -v<\/code>. One of our own VPS instances was already on 8.3.36, the fixed version, when we checked.<\/figcaption><\/figure>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\">What the vulnerabilities actually do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Both issues were published by the PHP project on 21 October 2026, both rated CVSS 9.2 (critical), and both can allow an attacker to run arbitrary code on an affected server without needing to log in first.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE-2026-109618<\/strong>, memory handling under out-of-memory conditions can leave internal request data only partially set up. If request cleanup then treats that incomplete data as valid, it can lead to remote code execution. According to PHP&#8217;s advisory, this risk is highest on mod_php setups, where a single unauthenticated request can trigger it before any of your own application code even runs.<\/li>\n<li><strong>CVE-2026-109619<\/strong>, internal state tied to one request can survive after its memory has been freed. If the same worker process handles a later request before that leftover state is reset, the new request may use stale data, which can also lead to remote code execution.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">PHP&#8217;s own advisory is direct about this: updating is the only complete fix. Settings like <code>memory_limit=-1<\/code>, a lower <code>post_max_size<\/code>, or turning off <code>session.upload_progress.enabled<\/code> only reduce exposure to specific attack paths. None of them make an unpatched server safe on their own.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Which PHP version fixes it<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead><tr><th>Your branch<\/th><th>Update to<\/th><\/tr><\/thead>\n<tbody>\n<tr><td>PHP 8.5.x<\/td><td>8.5.12<\/td><\/tr>\n<tr><td>PHP 8.4.x<\/td><td>8.4.27<\/td><\/tr>\n<tr><td>PHP 8.3.x<\/td><td>8.3.36<\/td><\/tr>\n<tr><td>PHP 8.2.x<\/td><td>8.2.35<\/td><\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">PHP 8.1 and older no longer receive official updates from the PHP project. The advisory does provide minimal source backports for 7.4, 8.0 and 8.1, but if you&#8217;re on one of these end-of-life branches, treat this as a strong reason to plan an upgrade to a supported version rather than relying on a backport indefinitely.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to check your version<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">From your server&#8217;s command line:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>php -v<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">On a cPanel server with EasyApache PHP, your active version&#8217;s binary is under <code>\/opt\/cpanel\/ea-phpXX\/root\/usr\/bin\/php<\/code> (for example <code>ea-php83<\/code> for PHP 8.3). Update through WHM&#8217;s MultiPHP Manager, or your distribution&#8217;s package manager if you installed PHP another way. If you run multiple PHP versions for different sites, check each one.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">One command to check and update<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;d rather not check first and decide separately, you don&#8217;t have to. Each line below prints your current version, then updates PHP through your system&#8217;s own package manager; if you&#8217;re already on the fixed version, the update step changes nothing. Pick the one that matches your server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">cPanel with EasyApache PHP, on AlmaLinux, CloudLinux or another RPM-based OS:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>php -v && yum update -y \"ea-php*\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">cPanel with EasyApache PHP, on Ubuntu:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>php -v && apt update && apt install --only-upgrade -y \"ea-php*\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Plain Ubuntu or Debian, PHP from your distribution&#8217;s repositories or the Ond\u0159ej Sur\u00fd PPA:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>php -v && apt update && apt install --only-upgrade -y php-common php-cli php-fpm<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">AlmaLinux, Rocky or another RHEL-family server, PHP from the Remi repository:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>php -v && dnf update -y \"php*\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These are standard package-manager commands, not a special script, so they behave the same way any other system update does: review what they plan to change if you have a staging copy to test against first, and run <code>php -v<\/code> again afterwards to confirm the version actually moved.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">If you&#8217;re on an Ucartz managed plan<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every Ucartz plan includes Free Basic Managed Support, and our Managed cPanel VPS, Managed Webmin VPS, Managed CWP VPS and other fully managed services include PHP and system patching as part of the service. If that&#8217;s you, there&#8217;s nothing you need to do, our team applies vendor security updates like this one as part of normal maintenance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you run a self-managed KVM VPS or an unmanaged dedicated server, PHP patching is on you, the same as any other software you install. It&#8217;s one of the trade-offs of full root access: more control, but also more responsibility for keeping what you install up to date.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to do right now<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Check your PHP version with <code>php -v<\/code> on every server and every PHP version you run.<\/li>\n<li>If you&#8217;re below the fixed version for your branch, update it today.<\/li>\n<li>Watch your logs for anything unusual in the meantime, PHP&#8217;s advisory notes a demonstrated exploit path already exists.<\/li>\n<li>If you&#8217;re not sure which plan you&#8217;re on or whether patching is included, open a ticket and our team will confirm.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">For a shorter, step-by-step version of the fix with the copy-paste commands and nothing else, see our knowledge base article <a href=\"https:\/\/www.ucartz.com\/clients\/knowledgebase\/9470\/How-to-Fix-the-Critical-PHP-Security-Vulnerabilities-CVE-2026-109618-CVE-2026-109619.html\">How to Fix the Critical PHP Security Vulnerabilities (CVE-2026-109618, CVE-2026-109619)<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Source: <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener noreferrer\">the PHP project&#8217;s official 21 October 2026 security release announcement<\/a>.<\/p>\n\n\n\n\n\n","protected":false},"excerpt":{"rendered":"<p>PHP fixed two critical unauthenticated RCE vulnerabilities on 21 Oct 2026. If you run a dedicated or self-managed server, update PHP now.<\/p>\n","protected":false},"author":16,"featured_media":4131,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[397],"tags":[1055,1056,994,403,36],"class_list":["post-4133","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cve","tag-patch","tag-php","tag-security","tag-vulnerability"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Critical PHP Security Update: What You Must Do | Ucartz<\/title>\n<meta name=\"description\" content=\"PHP fixed two critical unauthenticated RCE vulnerabilities on 21 Oct 2026. Includes a one-line command to check your version and update it now.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Critical PHP Security Update: What You Must Do - Ucartz Blog\" \/>\n<meta property=\"og:description\" content=\"PHP fixed two critical unauthenticated RCE vulnerabilities on 21 Oct 2026. Includes a one-line command to check your version and update it now.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/\" \/>\n<meta property=\"og:site_name\" content=\"Ucartz Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/UcartzOnline\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-22T12:44:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-22T13:30:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/10\/og-php-hotfix.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ithal P R\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/10\/og-php-hotfix.png\" \/>\n<meta name=\"twitter:creator\" content=\"@ucartz\" \/>\n<meta name=\"twitter:site\" content=\"@ucartz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ithal P R\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/\"},\"author\":{\"name\":\"Ithal P R\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/#\\\/schema\\\/person\\\/5dd81ab7f25e4f1b46b3ab7519cd0f77\"},\"headline\":\"Critical PHP Security Update: What You Must Do\",\"datePublished\":\"2026-10-22T12:44:06+00:00\",\"dateModified\":\"2026-10-22T13:30:04+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/\"},\"wordCount\":821,\"publisher\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/featured-php-security.png\",\"keywords\":[\"cve\",\"patch\",\"php\",\"Security\",\"vulnerability\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\"},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/\",\"name\":\"| Ucartz Blog | Ucartz\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/featured-php-security.png\",\"datePublished\":\"2026-10-22T12:44:06+00:00\",\"dateModified\":\"2026-10-22T13:30:04+00:00\",\"description\":\"PHP fixed two critical unauthenticated RCE vulnerabilities on 21 Oct 2026. Includes a one-line command to check your version and update it now.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/\"]}]},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/featured-php-security.png\",\"contentUrl\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/featured-php-security.png\",\"width\":1200,\"height\":630},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/critical-php-security-update-what-to-do\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Critical PHP Security Update: What You Must Do\"}]},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/\",\"name\":\"Ucartz Blog\",\"description\":\"Guides on hosting, servers, streaming and automation\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/#organization\"},\"alternateName\":\"Ucartz\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/#organization\",\"name\":\"Ucartz Online Private Limited\",\"alternateName\":\"Ucartz\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/assets\\\/images\\\/brand\\\/logo\\\/ucartz-logo-888x240.png\",\"contentUrl\":\"https:\\\/\\\/www.ucartz.com\\\/assets\\\/images\\\/brand\\\/logo\\\/ucartz-logo-888x240.png\",\"width\":888,\"height\":240,\"caption\":\"Ucartz\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/UcartzOnline\",\"https:\\\/\\\/twitter.com\\\/ucartz\",\"https:\\\/\\\/www.instagram.com\\\/ucartz_com\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/ucartzonline\",\"https:\\\/\\\/github.com\\\/ucartz\",\"https:\\\/\\\/n8n.io\\\/creators\\\/ucartz\\\/\",\"https:\\\/\\\/marketplace.whmcs.com\\\/group\\\/Ucartz\"]},{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/#\\\/schema\\\/person\\\/5dd81ab7f25e4f1b46b3ab7519cd0f77\",\"name\":\"Ithal P R\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f5a33c9e7f5df42637baf72daddd91b43a7a9d4d054cce0ba7920726f35cc91e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f5a33c9e7f5df42637baf72daddd91b43a7a9d4d054cce0ba7920726f35cc91e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f5a33c9e7f5df42637baf72daddd91b43a7a9d4d054cce0ba7920726f35cc91e?s=96&d=mm&r=g\",\"caption\":\"Ithal P R\"},\"description\":\"Hi, I'm Ithal! I write tech and hosting blogs at Ucartz.com, where I share insights, tips, and the latest updates from the world of web hosting and technology. Whether it's about server setups, control panels, or tools to power your online presence, I break things down in a way that's easy to understand, even if you're just starting out.\",\"url\":\"https:\\\/\\\/www.ucartz.com\\\/blog\\\/author\\\/ithal\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Critical PHP Security Update: What You Must Do | Ucartz","description":"PHP fixed two critical unauthenticated RCE vulnerabilities on 21 Oct 2026. Includes a one-line command to check your version and update it now.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/","og_locale":"en_US","og_type":"article","og_title":"Critical PHP Security Update: What You Must Do - Ucartz Blog","og_description":"PHP fixed two critical unauthenticated RCE vulnerabilities on 21 Oct 2026. Includes a one-line command to check your version and update it now.","og_url":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/","og_site_name":"Ucartz Blog","article_publisher":"https:\/\/www.facebook.com\/UcartzOnline","article_published_time":"2026-10-22T12:44:06+00:00","article_modified_time":"2026-10-22T13:30:04+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/10\/og-php-hotfix.png","type":"image\/png"}],"author":"Ithal P R","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/10\/og-php-hotfix.png","twitter_creator":"@ucartz","twitter_site":"@ucartz","twitter_misc":{"Written by":"Ithal P R","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@context":"https:\/\/schema.org","@type":"Article","@id":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/#article","isPartOf":{"@id":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/"},"author":{"name":"Ithal P R","@id":"https:\/\/www.ucartz.com\/blog\/#\/schema\/person\/5dd81ab7f25e4f1b46b3ab7519cd0f77"},"headline":"Critical PHP Security Update: What You Must Do","datePublished":"2026-10-22T12:44:06+00:00","dateModified":"2026-10-22T13:30:04+00:00","mainEntityOfPage":{"@id":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/"},"wordCount":821,"publisher":{"@id":"https:\/\/www.ucartz.com\/#organization"},"image":{"@id":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/#primaryimage"},"thumbnailUrl":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/10\/featured-php-security.png","keywords":["cve","patch","php","Security","vulnerability"],"articleSection":["Security"],"inLanguage":"en-US"},{"@context":"https:\/\/schema.org","@type":"WebPage","@id":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/","url":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/","name":"| Ucartz Blog | Ucartz","isPartOf":{"@id":"https:\/\/www.ucartz.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/#primaryimage"},"image":{"@id":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/#primaryimage"},"thumbnailUrl":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/10\/featured-php-security.png","datePublished":"2026-10-22T12:44:06+00:00","dateModified":"2026-10-22T13:30:04+00:00","description":"PHP fixed two critical unauthenticated RCE vulnerabilities on 21 Oct 2026. Includes a one-line command to check your version and update it now.","breadcrumb":{"@id":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/"]}]},{"@context":"https:\/\/schema.org","@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/#primaryimage","url":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/10\/featured-php-security.png","contentUrl":"https:\/\/www.ucartz.com\/blog\/wp-content\/uploads\/2026\/10\/featured-php-security.png","width":1200,"height":630},{"@context":"https:\/\/schema.org","@type":"BreadcrumbList","@id":"https:\/\/www.ucartz.com\/blog\/critical-php-security-update-what-to-do\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.ucartz.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Critical PHP Security Update: What You Must Do"}]},{"@context":"https:\/\/schema.org","@type":"WebSite","@id":"https:\/\/www.ucartz.com\/blog\/#website","url":"https:\/\/www.ucartz.com\/blog\/","name":"Ucartz Blog","description":"Guides on hosting, servers, streaming and automation","publisher":{"@id":"https:\/\/www.ucartz.com\/#organization"},"alternateName":"Ucartz","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.ucartz.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@context":"https:\/\/schema.org","@type":"Organization","@id":"https:\/\/www.ucartz.com\/#organization","name":"Ucartz Online Private Limited","alternateName":"Ucartz","url":"https:\/\/www.ucartz.com\/","logo":{"@type":"ImageObject","@id":"https:\/\/www.ucartz.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.ucartz.com\/assets\/images\/brand\/logo\/ucartz-logo-888x240.png","contentUrl":"https:\/\/www.ucartz.com\/assets\/images\/brand\/logo\/ucartz-logo-888x240.png","width":888,"height":240,"caption":"Ucartz"},"image":{"@id":"https:\/\/www.ucartz.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/UcartzOnline","https:\/\/twitter.com\/ucartz","https:\/\/www.instagram.com\/ucartz_com","https:\/\/www.linkedin.com\/company\/ucartzonline","https:\/\/github.com\/ucartz","https:\/\/n8n.io\/creators\/ucartz\/","https:\/\/marketplace.whmcs.com\/group\/Ucartz"]},{"@context":"https:\/\/schema.org","@type":"Person","@id":"https:\/\/www.ucartz.com\/blog\/#\/schema\/person\/5dd81ab7f25e4f1b46b3ab7519cd0f77","name":"Ithal P R","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f5a33c9e7f5df42637baf72daddd91b43a7a9d4d054cce0ba7920726f35cc91e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f5a33c9e7f5df42637baf72daddd91b43a7a9d4d054cce0ba7920726f35cc91e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f5a33c9e7f5df42637baf72daddd91b43a7a9d4d054cce0ba7920726f35cc91e?s=96&d=mm&r=g","caption":"Ithal P R"},"description":"Hi, I'm Ithal! I write tech and hosting blogs at Ucartz.com, where I share insights, tips, and the latest updates from the world of web hosting and technology. Whether it's about server setups, control panels, or tools to power your online presence, I break things down in a way that's easy to understand, even if you're just starting out.","url":"https:\/\/www.ucartz.com\/blog\/author\/ithal\/"}]}},"_links":{"self":[{"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/posts\/4133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/comments?post=4133"}],"version-history":[{"count":4,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/posts\/4133\/revisions"}],"predecessor-version":[{"id":4139,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/posts\/4133\/revisions\/4139"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/media\/4131"}],"wp:attachment":[{"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/media?parent=4133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/categories?post=4133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ucartz.com\/blog\/wp-json\/wp\/v2\/tags?post=4133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}