PHP security update: how Datasouth responded
Two serious security issues in PHP prompted urgent updates across the web on 21 October. Datasouth responded with overnight patching and checks on our hosting systems. All sites hosted by Datasouth have now had the relevant PHP security fixes applied, with representative websites checked after the work.
What happened?
PHP is software that runs behind the scenes on many websites and business applications. The issues, identified as CVE-2026-109618 and CVE-2026-109619, could allow an attacker to run unauthorised code on an affected server.
These are vulnerabilities in PHP itself, rather than a fault introduced by a particular website. That matters because updating a website’s content management system alone does not fix them: the underlying PHP software needs the appropriate security patch.
The PHP project released emergency updates on 21 October. Hosting-package providers can also supply fixes for existing installations, which means checking the actual package and its security changes—not simply looking at a website’s displayed version number.
What we did overnight
Our response focused on installing the fixes and checking the result, rather than relying on temporary workarounds.
- Checked the installed PHP packages. We reviewed versions and security-fix information to identify outstanding updates.
- Applied security updates. We installed updated PHP packages, including fixes for the current branches and available provider-maintained backports for older installations.
- Activated the updated software. PHP services were restarted and selected servers rebooted, followed by checks that the web server, database and PHP services were running.
- Checked website responses. We tested representative websites after the maintenance. Those checks returned successful responses; on the rebooted servers checked, we also confirmed that old PHP and Apache binaries were no longer loaded.
We kept existing website PHP-version selections unchanged during this work. That allowed security maintenance to be handled separately from larger application upgrades that may require compatibility testing.
What does this mean for clients?
A security advisory is a warning about a software weakness; it is not, by itself, evidence that a website has been compromised. Prompt patching addresses the known vulnerabilities, while post-update checks help confirm that services are working afterwards.
If Datasouth manages your hosting, please contact us if you would like confirmation for a particular website or application. If your hosting is managed elsewhere, ask that provider to confirm that these specific PHP fixes have been applied. There is no need to make speculative changes to your website in response to a general advisory.
Older applications still need a long-term upgrade plan. An emergency backport can address these particular issues, but it does not make an end-of-life PHP branch a fully supported platform again.
Security maintenance is part of looking after a website—not just building it. Our approach is to act promptly, verify the work and give clients clear advice about any further steps their own site needs.
Technical reference: PHP’s official security advisory.