21/10/2026: PHP released emergency patches for two critical vulnerabilities that allow remote code execution.
21/10/2026: PHP released emergency patches for two critical vulnerabilities that allow remote code execution.
Professional DonWeb service
The flaws announced on October 21 affect almost all PHP versions. We analyze whether your site or application is compatible with a fixed version and, if it is, we perform the update. If we can't, we'll let you know and refund u$s7000.
One-time payment of u$s9000 · Work included
On October 21, 2026, the PHP team released emergency updates for the vulnerabilities CVE-2026-109618 and CVE-2026-109619, rated as critical. Exploitation attempts have already been reported.
An attacker could execute code on your server without needing a username or password, even if your application is well programmed.
Only PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or higher are fixed. The rest must be updated.
These versions no longer receive fixes. You need to migrate to a supported version, which requires reviewing your code's compatibility.
You just hire it. We identify the services in your account that use PHP. You don't have to do anything technical.
We review the operating system and PHP version your site or application runs on, and whether they can be updated.
If possible, we update the operating system and PHP to a fixed version. Verifying that your site or application works with the new version is your responsibility.
We confirm that your site or application's environment has been updated or, if it wasn't possible, we refund u$s7000.
Includes the analysis and the update if your site or application is compatible.
If we can update it
We do the complete work at no extra cost. The u$s9000 cover everything.
If we can't update it
We'll let you know and refund u$s7000. Only the analysis performed is charged.
For all DonWeb services, including Cloud Servers and Dedicated Servers. The price is the same for each of them.
The payment covers the update of one service. If we detect that your account has other services that can be updated, we'll contact you to coordinate which one you want to start with and what you'd like to do with the others.
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or higher within each branch. Versions 8.1 and earlier have no official fix. Keep in mind that PHP 8.2 stops receiving support on December 31, 2026.
You can check it from your service's panel. If you can't find it, hire the analysis and we'll review it for you.
Yes. If you have technical knowledge you can do it. This service is for those who prefer a specialist to update their server's operating system and PHP. In Web Hosting and WordPress Hosting, the operating system update has already been performed.
In the vast majority of cases there will be no interruptions. If we determine that there might be one, we'll let you know to coordinate the best time to perform the update.
It depends on each case: the type of service, the size of the hosting accounts, and current demand. Demand is currently very high and we handle requests on a first-come, first-served basis, so the sooner you hire, the sooner we'll update your server.
If the problem is in the operating system or PHP, we fix it at no cost. If it's because your site or application's code, plugins, or themes aren't compatible with the new PHP version, adapting them is your responsibility.
We refund u$s7000 as a credit balance in your account after determining that we can't update your server's operating system and PHP. If you wish, you can later request a refund to the payment method used. Keep in mind that, in that case, there may be delays specific to the chosen payment method.
If it can be updated, we do it. If not, we refund u$s7000.
The service includes the update of the server's operating system and PHP; it does not include reviewing, modifying, or guaranteeing the operation of the client's site or application, whose compatibility with the new PHP version is the client's responsibility. DonWeb considers a service "non-updatable" when its operating system, panel, or configuration does not allow installing a fixed PHP version, such as servers with custom configurations. In such cases, the client can perform the update on their own. See the service's terms and conditions.