# Request for PHP Security Update Confirmation

**URL:** <https://forum.infinityfree.com/t/request-for-php-security-update-confirmation/121561>\
**Category:** Hosting Support\
**Created:** [October 24, 2026, 1:13pm UTC](https://forum.infinityfree.com/t/request-for-php-security-update-confirmation/121561 "2026-10-24T13:13:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shc001](https://forum.infinityfree.com/letter_avatar/shc001/32/5_5575768a8748004e209b776fc1b2916d.png) [@shc001](https://forum.infinityfree.com/u/shc001)\
**Post date:** [October 24, 2026, 1:13pm UTC](https://forum.infinityfree.com/t/request-for-php-security-update-confirmation/121561/1 "2026-10-24T13:13:01Z")

</div>

### Website URL

[https://takeyourseat.com.np](https://takeyourseat.com.np)

### Error Message

Hello InfinityFree Support Team,

Could you please confirm the latest patched PHP version available for my hosting account and whether it includes fixes for CVE-2026-109618 and CVE-2026-109619?

Thank you for your assistance.

Best regards,  
Website Administrator

### Other Information

Hello InfinityFree Support Team,

Could you please confirm the latest patched PHP version available for my hosting account and whether it includes fixes for CVE-2026-109618 and CVE-2026-109619?

Thank you for your assistance.

Best regards,  
Website Administrator

---

<div class="post-metadata">

**Author:** ![system](https://infinityfree-forum-uploads.s3.dualstack.eu-central-1.amazonaws.com/original/3X/b/0/b024fd3fa88bae093c9576e55c2c94e33f890206.svg) [@system](https://forum.infinityfree.com/u/system)\
**Post date:** [October 24, 2026, 1:13pm UTC](https://forum.infinityfree.com/t/request-for-php-security-update-confirmation/121561/2 "2026-10-24T13:13:01Z")

</div>

Welcome to the InfinityFree community forum! Good to have you here.

- Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end.
- Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong.
- AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first.
- Solving an issue is a joint effort. Try the suggestions you get and report back what happened.

---

<div class="post-metadata">

**Author:** ![Lemni](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/lemni/32/68303_2.png) [@Lemni](https://forum.infinityfree.com/u/Lemni)\
**Post date:** [October 24, 2026, 1:13pm UTC](https://forum.infinityfree.com/t/request-for-php-security-update-confirmation/121561/3 "2026-10-24T13:13:16Z")

</div>

_Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look._

The update has already been rolled out to everyone, so you don’t need to do anything. InfinityFree’s status page covers it:

> **[Critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) |...](https://status.infinityfree.com/issues/2026-10-22-php-security-vulnerabilities/)**
>
> Resolved - The PHP update has been successfully rolled out to all servers. All free hosting sites now run on PHP 8.4.27, which contains the fix. 
> (22 Oct - 12:52 UTC)
> 
> 
> 
> Identified - On October 21st, the PHP project released an emergency security...

An accepted answer in another topic says that upgrading to PHP 8.4.27 is enough to block the attack, and that this upgrade is complete. That topic quotes the PHP announcement saying CVE-2026-109618 and CVE-2026-109619 are fixed in 8.4.27, 8.3.36 and 8.2.35.

The other topic is here:

> [@Php cve](https://forum.infinityfree.com/t/php-cve/121512):
>
> Website URL Error Message PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod\_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application c…

I couldn’t find a source that says exactly which PHP version your account runs. To check, upload a small PHP file that calls `phpinfo();` or prints `PHP_VERSION`. If it shows 8.4.27 or higher on the 8.4 line (8.3.36 or 8.2.35 on those lines), you have the fixed version. If it shows something older, tell me what it says.