On 21 October 2026, PHP released fixes for two critical vulnerabilities that could allow an unauthenticated attacker to execute arbitrary code on affected servers. Because HYVOR products use PHP as their backend language, our engineering team began remediation immediately after the disclosure to minimize any potential exposure.
Summary
On 20 October, details about the exploitability of the vulnerabilities began circulating on several internet forums. PHP published its security release on 21 October at 14:00. By then, Cloudflare had already deployed firewall protection against the exploit (as of 03:12), so HYVOR's public infrastructure was already shielded. Our team became aware of the issue at 15:40. As an immediate mitigation, we temporarily disabled image uploads across all HYVOR products to address CVE-2026-109618, and disabled the PHP feature that enabled CVE-2026-109619.
The PHP security advisory recommended upgrading immediately. However, FrankenPHP, the runtime that powers all our applications, did not publish an updated Docker image until 17:47. Once the image was available, we upgraded all products to the patched PHP/FrankenPHP version between 17:47 and 18:28. We then re-enabled image uploads, and all services were fully restored by 18:35.
What happened
PHP's security advisory covers two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 score of 9.2, and either can be exploited by an unauthenticated attacker to achieve remote code execution. The issues are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
PHP issued advance notice on 20 October and published the fixes the following day, scheduled for 14:00 UTC. According to the advisory, all PHP deployments that serve web requests are affected, including FrankenPHP.
Our products run on FrankenPHP's official Docker image with PHP 8.4. A complete fix therefore required a FrankenPHP image built on PHP 8.4.27, which was not yet available. Until it was, our priority was to block potentially malicious requests from reaching our servers.
We will not cover the technical details of the exploits here. For more information, refer to the two GitHub security advisories: GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
How we responded
All times are UTC, the same as our status page.
Time (UTC) | What happened |
14:00 | PHP releases patched versions. |
15:40 | Our team begins investigating and posts an "Investigating" notice on the status page. By this time, Cloudflare had already deployed a firewall protection. So, our most of our public infrastructure was protected. |
15:52 | We decide to block file-upload requests and disable the vulnerable PHP session feature until a patched FrankenPHP image is available. |
15:53-16:17 | A blocking rule is added to the web server configuration for Core, Hyvor Talk, Hyvor Blogs, Hyvor Relay, Hyvor Post, and FortGuard, and the PHP session feature exploited by CVE-2026-109619 is disabled. |
16:50 | The staging environment is shut down as a precaution. |
17:47 | FrankenPHP publishes patched releases, and we begin rolling them out to all products. |
18:21 | Hyvor Blogs and Hyvor Post are patched and live. |
18:23 | Hyvor Talk and Core, our highest-traffic products, are patched and live. |
18:25 | FortGuard is patched and live. |
18:28 | Hyvor Relay is patched and live. |
18:30 | All products are re-tested and confirmed to run PHP 8.4.27 or later. |
18:35 | File uploads are re-enabled across all products. |
18:40 | Incident marked as resolved on the status page. |
Impact and current status
Was any data accessed?
We reviewed logs, requests, and system activity from 20 to 22 October and found no evidence that either vulnerability was exploited against HYVOR services.
What was disrupted?
File uploads were unavailable across all products from approximately 15:53 to 18:35 UTC. All other functionality remained operational.
Current status
As of 18:35 UTC on 21 October:
All HYVOR products are running the patched PHP release.
File uploads have been re-enabled.
All temporary blocking rules have been removed.
The incident has been marked as resolved on the status page.
Things Learned
Our team responded as soon as we became aware of the issue. We had the tools we needed to act quickly: Cloudflare's firewall, a deployment process that let us ship fixes fast, and global configuration options to temporarily disable features.
However, the incident also exposed several weaknesses that could have caused more serious problems. We are addressing them in the coming days:
Delayed awareness. PHP published advance notice on 20 October, but our team did not learn of it until the issue appeared on developer news sites the next day. This was the main shortcoming on our side. Because our products depend heavily on PHP, we are improving how we monitor PHP security announcements so that we are alerted as soon as they are published.
Dependency on the PECL registry. When the fixes were released, developers worldwide began rebuilding their PHP images and upgrading at the same time, which made the PECL registry intermittently unavailable. We are reviewing how to reduce our reliance on PECL during critical builds.
Delays in the image pipeline. Although PHP released patched versions at 14:00, the official PHP Docker images took time to publish, which in turn delayed the FrankenPHP images until 17:47. We are evaluating ways to shorten this pipeline so we can deploy patches sooner after release.
If you self-hosting our products
Please upgrade to the latest versions as soon as possible:
We have also released version 0.0.5 of our hyvor-blogs-docker package, which includes the patched PHP version. If you use this package, please upgrade it as well.
Enterprise self-hosted customers: your account manager will contact you directly, if they have not already.
If you run PHP in your own environment, upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you cannot upgrade immediately, PHP's security advisory lists temporary mitigations you can apply in the meantime.
Thank you
We would like to thank the PHP security team and release managers for shipping fixes across four release lines simultaneously, and the FrankenPHP maintainers for publishing patched releases the same evening.
And thanks to our engineering team who dedicated their evening to resolving this incident.
Comments