PHP security update: Crescat is patched
22 October 2026 · The Crescat team
As you may have heard, yesterday (21 October 2026) the PHP project released fixes for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, also known as "php2shell". PHP is the programming language behind a large part of the web, including Crescat. In response to this release, we updated every Crescat environment to the fixed PHP version on 21 October 2026.
What happened?
The existence of vulnerabilities was announced by the PHP team 23 hours prior to them making the patch available for download. More information on the vulnerabilities can be found on the PHP website, here.
What we did
We updated every Crescat environment to the fixed PHP version on 21 October 2026, within hours of the release. We then reviewed our logs and monitoring for signs of an attack and found none. As a precaution, we are also replacing the passwords and keys our systems use.
What we are currently doing
We are continuing to monitor our logs and any further security updates from PHP, to ensure we are protected moving forward.
Do you need to do anything?
No. Crescat is a hosted service, so the fix was made on our side. Your data, logins and integrations work as before.
If you run your own PHP-based systems, such as a WordPress website, ask whoever maintains them to confirm they have been updated.
Questions? Contact us at support@crescat.io.