Update 10/21/2026 @ 1454: Patches have been released and the vulnerabilities have been disclosed: https://www.php.net/archive/2026.php#2026-10-21-5. Upstream images are building and Mautic will update the Docker image when they become available.
Latest updates
This post now includes the fixed versions.
This afternoon the PHP security team released the fixes they warned us about last night. They close two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 under CVSS v4.0, and both let an attacker run code on a server without logging in (PHP Group, 2026c). That’s about as serious as it gets, so if you look after a Mautic instance, please make this today’s top job!
Which versions you need
There’s one fixed version for each supported PHP branch.
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Stay on the branch you already run (so 8.3.x moves to 8.3.36, for example). That keeps you on a PHP version your Mautic release already supports, and saves a stressful branch upgrade on the same day as a security fix!
Every PHP installation that serves web requests is affected, whether it runs through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed, and the advisory rates the risk highest for mod_php (PHP Group, 2026c).
If your packages haven’t caught up yet, keep checking through the day. The PHP team has flagged that the remirepo repository (which lots of RHEL, Rocky and AlmaLinux servers use) won’t have updates today (PHP Group, 2026c), so if that’s you, keep a close eye on it and look at the interim steps further down.
If you’re on PHP 8.1 or older
PHP 8.1 and older no longer get releases from the PHP project, so there’s no official fixed version for them. This one matters for us, because Mautic 5.2 and Mautic 6 can both still run on PHP 8.1 and we know a good percentage of people are still running these versions of PHP with their Mautic instances. The PHP security team has published minimal source backports for PHP 7.4, 8.0 and 8.1, and some Linux distributions and long term support vendors are backporting the fixes too (PHP Group, 2026c).
The better route is a supported branch. Mautic 5.2 and 6 both support PHP 8.3, so moving to PHP 8.3.36 is a sensible step, and Mautic 7 runs on PHP 8.2 right up to 8.5. Please test on a copy first if you can!
A heads up for everyone on PHP 8.2 as well – it reaches end of life on 31 December 2026, so now’s a good moment to plan your next upgrade.
If you can’t update straight away
The advisory lists some settings that reduce the risk while you wait. Set them in php.ini or your PHP-FPM or server config (not with ini_set() in code).
- memory_limit=-1 (for CVE-2026-109618)
- session.upload_progress.enabled=0 (for CVE-2026-109619)
- fatal_error_backtraces=0 on PHP 8.5 (also for CVE-2026-109619)
Please treat these as a stopgap only. The PHP team is clear that none of them make a server safe, and only updating fixes the problem (PHP Group, 2026c). An unlimited memory limit also means one runaway process can eat all the memory on a busy Mautic server, so update as soon as you can and then put your usual limit back.
What happened
Last night the PHP security team gave advance notice of a security release coming out today, Wednesday 21 October 2026 at 14:00 UTC. It fixes two critical vulnerabilities, and both are rated 9.2 under CVSS v4.0, which is about as serious as these scores get (PHP Group, 2026a).
Mautic is built on PHP, so if you run your own Mautic instance, this one is for you. Here’s what we know, and what we’d suggest doing before the release lands.
What we know right now
PHP hasn’t shared any technical details yet. The affected versions, the fixed versions and the full write up will all be published alongside the release itself (PHP Group, 2026a). They’ve also said they might release earlier than planned if details of either vulnerability become public, or if they see signs of attackers using them in the wild (PHP Group, 2026b).
You’ll probably see CVE numbers, different severity scores and all sorts of theories floating around on social media today. We’re sticking to what php.net and the official PHP announce list say, and we’d suggest you do the same until the release is out.
What to do before 14:00 UTC
- Check which PHP version your Mautic server runs. In Mautic you can find this under Settings (the cog), then System info. On the command line, php -v does the job (just make sure it’s the same PHP your web server and cron jobs use – it’s easy to have more than one installed).
- Check that your PHP branch is still supported. PHP only ships security fixes for supported branches, and you can see where each one stands on the PHP supported versions page. If you’re on a branch that’s reached end of life, it may never get this fix, so it’s time to plan that upgrade.
- Work out who updates PHP for you. If you manage your own server or VPS, that’s you! If a host, an agency or a Mautic partner looks after your instance, drop them a line today and ask when they plan to apply the release.
- Take a backup. A fresh backup of your database and your Mautic files, and a full, tested backup of your whole server, means you can update with confidence and roll back if anything goes sideways.
- Line up a maintenance window. If you can, block out some time this afternoon or this evening so you can update PHP as soon as packages are available for your platform.
What to do once the release is out
Head over to php.net after 14:00 UTC to see which versions are affected and which versions fix them. Update PHP, restart PHP-FPM or your web server (and anything else that keeps PHP running, like queue workers), then check php -v and Mautic’s System info again to make sure the new version is the one actually in use. A quick look at your cron jobs and a test email is a nice final check.
If you use packages from your Linux distribution or a third party repository, it can take a little while for updated packages to appear, so keep an eye on your usual source.
Mautic will release updated Docker builds just as soon as the upstream PHP images are available – it may take some time for them to build, we will share updates via the Docker channel on Slack.
Need a hand?
If you’re stuck, please do ask in the Mautic forum or in our community Slack, and if you’d rather someone else took care of it, the Mautic partners directory is a great place to find help.
Thank you for keeping your Mautic instances (and the contacts whose data lives in them!) safe. Looking after our own infrastructure is a big part of what makes self hosting worth it, and it’s lovely to see our community look out for each other on days like this.
Note about Mautic trials
We will be temporarily removing the signup form for the Mautic Trials while we update the infrastructure with the patches – as soon as this is completed we will restore signups.
References
PHP Group (2026a) Upcoming critical PHP security release. Available at https://www.php.net/archive/2026.php#2026-10-20-1 (Accessed 21 October 2026).
PHP Group (2026b) [ANNOUNCE] Upcoming critical PHP security release. php.announce mailing list, 20 October. Available at https://news-web.php.net/php.announce/509 (Accessed 21 October 2026).
PHP Group (2026c) Security advisory: critical remote code execution vulnerabilities, update now. Available at https://www.php.net/archive/2026.php#2026-10-21-5 (Accessed 21 October 2026).
PHP Group (2026d) PHP 8.2.35 released! Available at https://www.php.net/archive/2026.php#2026-10-21-1 (Accessed 21 October 2026).
