We have applied the Debian security updates for PHP 8.4.27, addressing the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 disclosed by the PHP project today.

All installed PHP 8.4 components were updated, and the PHP workers were restarted onto the patched code. Configuration checks passed. Webmail, Ident.ink, nicbtw.blog and the status site responded normally after the update; the admin site retained its expected sign-in redirect.

This was a focused security update. No websites or customer data were removed. These checks confirm the fixes for the two named vulnerabilities; they are not a claim that any system is free of every possible vulnerability.

Official PHP advisory: https://www.php.net/archive/2026.php#2026-10-21-5

Service status: https://status.ident.ink