October 2026 opened two critical holes in PHP (CVE-2026-109618 and CVE-2026-109619). Most sites still need the host update. Official floors are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older have no official fix. Source: CISA (updated 2026-10-23) and PHP.net archive 2026-10-21.

Bedrock finds the risk, alerts the same day, hardens what it can, and watches while the host patches. It does not patch PHP itself. Only a patched PHP plus a worker restart fully fixes it.

Read the Black October note or Your PHP version is at risk.