How we handled the October 2026 PHP security update
Early on Thursday 22 October 2026 (AEDT), the team behind PHP released fixes for two security issues. PHP is the programming language that VaocherApp’s servers, and a large share of the web, run on.
We started preparing as soon as PHP announced the release and installed the fixes once they were ready for our servers. By about 9:30 AM AEDT, VaocherApp was running on the updated PHP. You don’t need to do anything.
What happened
PHP is the programming language behind about 69% of websites whose language is known (W3Techs, 21 October 2026). WordPress runs on it, and so does VaocherApp.
On 20 October, the PHP team gave advance notice of a security release. Early on 22 October (AEDT), it released the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP’s advisory).
The two issues, CVE-2026-109618 and CVE-2026-109619, could let someone run unwanted code on a web server that uses PHP. PHP asked everyone running it to update as soon as possible. It was an update for the whole web, not something specific to VaocherApp.
What we did
VaocherApp was running on the fixed PHP about four hours after the update was ready for our servers.
| When (AEDT) | What happened |
|---|---|
| Wed 21 Oct | We read PHP’s notice, checked which PHP versions our servers run and planned the update. |
| Wed 21 Oct | We set up a protective change, turning off a PHP feature VaocherApp doesn’t use. PHP’s advisory later recommended this step. |
| Thu 22 Oct, 12:35 AM | PHP released the fixed versions. |
| Thu 22 Oct, about 5:30 AM | Ready-to-install versions for our servers’ operating system became available. |
| Thu 22 Oct, morning | We installed the update once the busy download servers let it through. |
| Thu 22 Oct, about 9:30 AM | VaocherApp was running on the updated PHP. |
Why it took a few hours. PHP releases its fixes as raw code, which has to be packaged for each type of server before it can be installed. The package for our servers was ready at about 5:30 AM. When we started the update, people all over the world were downloading it at once. The download servers were overloaded and kept turning requests away, so we kept trying until it came through.
What this means for you
You don’t need to do anything. The servers behind VaocherApp, including your dashboard and checkout, now run on the updated PHP.
If your own website runs on PHP, such as a WordPress site, it’s worth a quick check with your web host or developer:
- Ask them to confirm your site is on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer.
- PHP 8.1 and older don’t get fixes from the PHP team, so ask your host about moving to a newer version.
- If you use our WordPress plugin, the plugin itself doesn’t need an update. What matters is the PHP version your website runs on.
If you have any questions, our support team is happy to help.
How we look after security
Most security work happens quietly, out of sight. This update shows how we approach it:
- We start preparing as soon as a security fix is announced, not when it arrives.
- We switch off features VaocherApp doesn’t use, so there are fewer ways in.
- We confirm our live servers are running the fixed version before we call the job done.
- Alongside one-off fixes like this, we carry out routine maintenance on our servers.
