Questions:
What is the preferred version of PHP to install and what version of the Core should I be running (a System check says all modules and skins are up to date).
NOTICE:
On 21 October 2026, the PHP project released fixes for two critical vulnerabilities that can allow unauthenticated remote code execution. Active exploitation has been reported.
As we have no access to your VPS, VDS or dedicated server, we cannot apply the update for you. We therefore ask you to install it immediately as soon as patched packages are available for your system.
The vulnerabilities
CVE-2026-109618: remote code execution via out-of-memory corruption
CVE-2026-109619: remote code execution via stale global state
Both are rated 9.2 (critical) on the CVSS v4.0 scale. All PHP installations serving web requests are at risk (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed). Risk is highest for mod_php. Full details are in the official PHP security advisory.
Fixed PHP versions available
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35 (end of life on 31 December 2026, so please plan an upgrade)
JAMROOM
