PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are available (Security update)
The CERT-EU security advisory 2026-018 describes two critical vulnerabilities affecting PHP, CVE-2026-109618 and CVE-2026-109619. With a CVSS v4 score of 9.2, both can allow unauthenticated remote code execution on PHP installations serving web requests. The PHP security advisory gives the technical details and the mitigations available until you update.
We set up an analysis team on the evening of 20 October 2026 to follow the issue and apply fixes as they become available. Affected customers received an alert through the Console on the morning of 21 October 2026, followed by an email.
A dedicated maintenance on the status page shares updates on the fixes.
Active mitigations
Before the release of the new PHP versions, we set session.upload_progress.enabled to Off on all our customers’ PHP with Apache instances, following the PHP security team recommendations. This setting only disables upload progress tracking in sessions. We didn’t block multipart/form-data requests, as this could break your applications. The PHP security team validated this attack path against mod_php, but hasn’t demonstrated a complete exploit against PHP-FPM, which our PHP instances use.
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are now available on Clever Cloud, and we are redeploying your PHP applications so they use them automatically. If your application uses one of these branches, you have nothing to do.
PHP 8.1 and earlier reached end of life and no longer receive updates from the PHP project. We are studying a backport of the fixes to these versions. They nevertheless remain end of life and affected by many other vulnerabilities, so we recommend that you migrate without delay to a supported version such as PHP 8.3, 8.4 or 8.5 (PHP 8.2 reaches its end of life on 31 December 2026).
FrankenPHP 1.13 is now the only supported version
FrankenPHP 1.13 is now the only version supported on Clever Cloud, whatever the value of CC_PHP_VERSION. Major vulnerabilities affect all earlier versions, and FrankenPHP maintainers consider the 1.12 branch as end of life.
The available release, FrankenPHP 1.13.1, includes the fixes.
Managed Matomo add-ons
We moved every managed Matomo add-on that ran PHP 8.1 or 8.2 to PHP 8.3.
If you have any questions or need help, contact your sales representative or Clever Cloud support.