The PHP security team has released emergency fixes for two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619). Both can let an attacker run code on a web server without logging in. Details of the flaws leaked a day before the fix was ready, so attackers may already know how to target unpatched servers. Joomla runs on PHP, so any Joomla site on an unpatched PHP version could be exposed.

Note: Please note these issues are not specific to Joomla, and no Joomla or extension update is required. The fix is a PHP update on your server.

Which PHP versions are fixed?

The patched releases are:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

If you're on PHP 8.1 or older, your version no longer receives regular security updates, so you'll need to upgrade to one of the versions above.

Keep in mind that updating Joomla or your extensions doesn't change your PHP version. PHP runs on your hosting server, so the update happens in your hosting account or through your hosting provider.

What to do right now

  1. Check your PHP version. In your Joomla administrator, go to System > System Information and look at the PHP version.
  2. Back up your site (files and database) before making any changes.
  3. Update to a patched version. Most hosting dashboards let you switch PHP versions yourself. If you can't find the setting, ask your host to move you to a patched release. If you manage your own server, update PHP and restart your web server or PHP-FPM so the new version takes effect.
  4. Test your site. Before switching, confirm that your Joomla version and extensions support the PHP version you're moving to. If you're unsure, try it on a staging copy first. After the switch, check your key pages, forms, and extensions on both the front end and the back end.
  5. Check for signs of a break-in. Updating PHP stops new attacks, but it won't remove an attacker who is already in. Look for Super User accounts you don't recognize (Users > Manage) and for PHP files that were added or changed unexpectedly, especially in writable folders such as images, tmp, and cache.

If you can't update right away

Many managed hosts have already applied the fix, but rollouts are still in progress elsewhere, so contact your host and confirm that PHP has been updated on your account.

If you're on an unsupported PHP version and can't upgrade immediately, consider taking your site offline until you can. In Joomla, go to System > Global Configuration > Site and set Site Offline to Yes.

A note on JoomShaper products

Joomla or our extensions don't require an update for this issue, because the fix is at the server level. As always, keep Joomla, your templates, and your extensions up to date alongside PHP.

Learn More