PHP 7.4.33, 8.0.30 and 8.1.34 patched for CVE-2026-109618 and CVE-2026-109619 (Security update)
Following the release of PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, we applied the fixes for the critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 to the PHP 7.4, 8.0 and 8.1 branches, which reached end of life.
Patched builds of PHP 7.4.33, 8.0.30 and 8.1.34 are now available on Clever Cloud, and we’re redeploying your PHP applications so they use them automatically. If your application uses one of these branches, you have nothing to do.
These builds only fix CVE-2026-109618 and CVE-2026-109619. PHP 8.1 and earlier remain affected by many other vulnerabilities, so we recommend that you migrate without delay to a supported version such as PHP 8.3, 8.4 or 8.5 (PHP 8.2 reaches its end of life on December 31, 2026). To change the PHP version of your application, set the CC_PHP_VERSION environment variable and redeploy it:
clever env set CC_PHP_VERSION 8.5
clever restart --without-cacheThe dedicated maintenance on the status page keeps sharing updates on the fixes. If you have any questions or need help, contact your sales representative or Clever Cloud support.