PHP Vulnerabilities October 2026

PHP Vulnerabilities October 2026

The past few days, several computer security incident response teams (CSIRTs) have reported two vulnerabilities in PHP. Details of these Common Vulnerabilities and Exposures (CVEs) aren’t available yet. Once they are published, BIT will assess the vulnerabilities and take action where necessary. This may involve mitigation measures or software updates. BIT staff are highly active in abuse prevention communities and keep up to date with the latest developments. Once the precise impact and risks of the vulnerabilities are known, we’ll be able to determine which measures to take.

Some information about the vulnerabilities has been released, indicating where the issues may lie. Yesterday, BIT implemented mitigation measures on the systems we manage, which may prove sufficient. Customers who would like BIT to deactivate their systems or websites as a precaution can contact our Customer Care department on +31 318 648 688. As the full details are not yet available, we can’t make an informed recommendation on whether precautionary deactivation is necessary.

The BIT team is ready to act. We have the experience and tools to respond quickly, as we’ve done on previous occasions involving serious vulnerabilities. Once we’ve determined what action to take, we’ll announce it as emergency maintenance.