SECURITY RESEARCH & NOTICES

Observed facts.
Actionable next steps.

EVIDECT is an initiative that helps organizations understand security concerns through public information and external observations. We distinguish what has been confirmed from what still needs checking.

Received a notice?Read the PHP advisory

Operated by VeritasChain Co., Ltd. · Free security information

EVIDENCE → ACTIONTRACEABLE SOURCES

Establish the facts

Review published technical information and observations.

Assess the uncertainty

Separate confirmed facts, possibilities and unknowns.

Explain the next steps

Share sources and practical checks with the responsible team.

A product fingerprint alone does not establish a vulnerability or a compromise.

SECURITY ADVISORY

For organizations using PHP

An urgent request to check your environment and act on the official PHP advisory.

URGENT SECURITY INFORMATION · FIXES AVAILABLE

Two critical vulnerabilities in PHP

Information checked: 21 October 2026

The PHP project has published fixes for two critical vulnerabilities that can allow unauthenticated remote code execution. If PHP handles web requests in your environment, contact your server administrator, maintenance partner or hosting provider and act promptly.

Severity · CVSS v4.09.2 / 10

Vulnerabilities2

IdentifiersCVE-2026-109618
CVE-2026-109619

Fixed PHP releases

Use the fixed release for your branch, or a later release containing the fixes
PHP branch	Fixed release
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

Your operating system or hosting provider may supply packages with backported fixes. A displayed version number alone does not establish patch status; check the provider's advisory.

For PHP 8.1 and earlier, check your vendor's fix availability or migrate to a supported branch.

What to do now

Identify PHP use across public websites, ecommerce and member services, including the running versions and configurations.
Apply a fixed release or the provider's patched package, then perform the required restarts and verify the running system.
If you cannot update promptly, discuss restricting exposure or temporarily taking the affected service offline. Do not treat temporary measures as a complete fix.

Updating WordPress or its plugins is separate from addressing the PHP runtime on your server.

This is a general security advisory. It does not mean EVIDECT has confirmed a vulnerability, compromise or missing patch at any particular organization. Check the official sources below for updates before taking action.

FOR RECIPIENTS

Received a notice from EVIDECT?

Share it with your IT or security team, or the partner responsible for maintaining your website.

Understand the purpose

We share significant security information and relevant checks free of charge. Receiving a notice does not create a contract or a payment obligation.

Compare sources with your environment

Review the cited sources and any identified URLs. Your administrator should confirm the actual configuration, version and patch status.

Verify the contact

Our contact address for these notices is info@veritaschain.org. If you have questions, use the contact information on this page.

WordPress fingerprints or displayed versions do not prove the running PHP version, exposure to these vulnerabilities or compromise. Observations may reflect older information or statically generated pages.

ABOUT EVIDECT

Evidence and limitations.
Presented together.

Our aim is to turn observable information into security concerns that organizations can evaluate. We do not present facts that cannot be established externally as confirmed findings.

We distinguish general advisories from notices about specific observations. We do not perform unauthorized intrusion, authentication bypass or exploitation against third-party systems.

Name: EVIDECT
Operator: VeritasChain Co., Ltd.
Contact: info@veritaschain.org
Development: Research service in development
Evidence integration using VAP, OAP and DAP is at the design stage. No conformance test results or independent verification results have been published.

FAQ

Frequently asked questions

Does a notice mean my systems have been compromised?

No. This PHP notice shares an official critical security advisory and asks you to check your environment and apply the relevant fixes. It does not assert a confirmed vulnerability or compromise at your organization.

Is updating WordPress enough?

The issue affects PHP itself. Updating WordPress or its plugins does not necessarily patch the PHP runtime on the server. Check with the administrator or hosting provider responsible for PHP.

Do I need to reply or buy a service?

No purchase is required, and a reply to a general advisory is not mandatory. Prioritize reviewing the issue with your administrator or maintenance provider.

Can this contact provide emergency incident response?

This address handles questions about our notices. It does not guarantee round-the-clock monitoring or emergency incident response. If you suspect an incident, also contact your existing maintenance or incident response provider.

CONTACT

Questions about a notice?

Send a brief summary, such as the relevant domain and the notice subject. Do not send passwords, API keys, customer data or details of undisclosed vulnerabilities.

Free security notices do not require a service purchase.

info@veritaschain.org ↗