On October 21, 2026, Romega Digital completed a critical security update to PHP, software that helps power many websites and applications.
The update is complete for the affected applications covered by this response, and no action is required from those customers. We have found no evidence of data loss or exposure related to these vulnerabilities. Here is what happened, how we responded, and what our customers can expect from us going forward.
What happened?
On October 21, 2026, the PHP team released fixes for two critical security vulnerabilities: CVE-2026-109618 and CVE-2026-109619. These affected PHP itself, a shared component used by websites and applications across the Internet. Read the official PHP advisory.
PHP powers roughly 70% of websites whose server-side programming language is known, according to W3Techs. Its widespread use made these vulnerabilities a concern for organizations across the Internet.
What was the risk?
Under certain conditions, an attacker could exploit these vulnerabilities to run unauthorized code on an affected server without logging in. This could put application data and service availability at risk.
The potential impact made prompt patching essential. It does not mean that an affected application was attacked or that its data was accessed.
What was the timeline?
All times below are Eastern Daylight Time (EDT).
- October 20: The PHP team published advance notice of the critical release. Romega prepared the affected infrastructure and deployment checks.
- October 21, 10:00 a.m.: The PHP team’s scheduled release window began, with PHP 8.5.12 providing the fixes for our systems.
- October 21, 10:06 a.m.: Romega confirmed the official release and began the response, testing the update in staging before proceeding through the affected systems.
- October 21, by 10:58 a.m.: The security update and initial verification were complete across the affected systems covered by this response.
What actions did Romega take?
We:
- Prepared the affected systems on supported operating system and PHP versions.
- Applied PHP 8.5.12 across the affected environments.
- Restarted application services and background workers to ensure they used the patched software.
- Checked application compatibility, server services, secure connections, and application availability.
- Reviewed server logs and application error reports, and continued monitoring after the update.
What happens from here?
We will continue to monitor published security vulnerabilities and apply relevant patches as they become available.
Our application monitoring also reports many errors directly to us, so we can investigate and address issues related to this update. Proactive fixes covered by your current support plan will continue as usual.
If you experience an issue, please email support@romegadigital.com with a description of what happened and the page or feature involved. We’ll be happy to help. If you’re unsure what your support plan covers, contact us at the same address and we can walk you through the available options.
A message from our CEO
As AI continues to grow in capability, it’s getting better at a lot of things. One of those is spotting bugs and security issues. These particular issues had been present in PHP for many years. Researchers at Calif used OpenAI’s technology to identify a critical flaw, while Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the fixes, with OpenAI and other partners helping coordinate the response. More about the discovery and response.
I don’t expect this to be the last time we see this. There are decades of core services running on the Internet that were written by people. AI will continue helping to find these issues with each model release and as it becomes more capable. I see a time in the future when all human-written code has been vetted by our most capable models and we can enter a period of peace.
For now, I expect there will continue to be bugs, both big and small, that require us to respond quickly to keep our work secure. We take security very seriously, and I could not be more proud of the position our systems and services were in to handle this issue promptly and with minimal disruption. We are committed to providing stable application experiences, and this event has put our practices to the test. I am happy with the outcome.
As the Internet landscape continues to reshape, we’ll be with you every step of the way. I’m grateful for the trust you put in Romega to provide services to your business.
—Braden
