Status update: critical PHP vulnerabilities and the measures Wabber is taking
The PHP Security Team has warned of two critical vulnerabilities in PHP, both with a severity score of 9.2 out of 10. Because PHP is used worldwide for websites and business-critical applications, this warning calls for swift action. Wabber also uses PHP to develop software. That is why we immediately started assessing the possible impact on our applications and server environments.
Which measures have we taken?
Our applications run both on servers we manage ourselves and on infrastructure of external partners. This means we cannot implement security measures independently in every environment.
On our own servers we have by now largely put mitigating measures in place to limit the risks. For environments where we cannot carry out these measures ourselves, we have informed the responsible parties and are supporting them in taking appropriate measures.
In this way we limit the possible risks wherever that is within our reach, while taking the availability of the applications into account.
What is the current status?
The PHP Security Team announced security updates for 21 October 2026 at 15:45 Dutch time. The first updates are now being released. It may, however, take some time before all server environments have been updated.
Because administrators worldwide want to update at the same time, we also expect the release servers to become overloaded. Downloads may therefore be slower or temporarily fail.
For environments that use Plesk, DirectAdmin or remi repositories, we also depend on the availability of updated PHP packages. These are expected to be released later.
Are you running an outdated PHP version?
Is your environment still running PHP 5.x or PHP 7.x? Then we advise moving to a supported PHP version as soon as possible. These older versions no longer receive official security updates from PHP.
If a safe migration is not immediately possible, we advise temporarily shielding the environment concerned or, when necessary, taking it offline.
We continue to follow developments closely and assess new security updates as soon as they become available. Where necessary, we take additional measures to further limit the risks to our applications and to our customers' business processes.
Also read
Marketing Coordinator at Wabber B.V.