Originally published at: https://mautic.org/blog/critical-php-security-release-today-please-get-your-mautic-servers-ready
Last night the PHP security team gave advance notice of a security release coming out today, Wednesday 21 October 2026 at 14:00 UTC. It fixes two critical vulnerabilities, and both are rated 9.2 under CVSS v4.0, which is about as serious as these scores get (PHP Group, 2026a).
Mautic is built on PHP, so if you run your own Mautic instance, this one is for you. Here’s what we know, and what we’d suggest doing before the release lands.
What we know right now
PHP hasn’t shared any technical details yet. The affected versions, the fixed versions and the full write up will all be published alongside the release itself (PHP Group, 2026a). They’ve also said they might release earlier than planned if details of either vulnerability become public, or if they see signs of attackers using them in the wild (PHP Group, 2026b).
You’ll probably see CVE numbers, different severity scores and all sorts of theories floating around on social media today. We’re sticking to what php.net and the official PHP announce list say, and we’d suggest you do the same until the release is out.
What to do before 14:00 UTC
- Check which PHP version your Mautic server runs. In Mautic you can find this under Settings (the cog), then System info. On the command line, php -v does the job (just make sure it’s the same PHP your web server and cron jobs use – it’s easy to have more than one installed).
- Check that your PHP branch is still supported. PHP only ships security fixes for supported branches, and you can see where each one stands on the PHP supported versions page. If you’re on a branch that’s reached end of life, it may never get this fix, so it’s time to plan that upgrade.
- Work out who updates PHP for you. If you manage your own server or VPS, that’s you! If a host, an agency or a Mautic partner looks after your instance, drop them a line today and ask when they plan to apply the release.
- Take a backup. A fresh backup of your database and your Mautic files, and a full, tested backup of your whole server, means you can update with confidence and roll back if anything goes sideways.
- Line up a maintenance window. If you can, block out some time this afternoon or this evening so you can update PHP as soon as packages are available for your platform.
What to do once the release is out
Head over to php.net after 14:00 UTC to see which versions are affected and which versions fix them. Update PHP, restart PHP-FPM or your web server (and anything else that keeps PHP running, like queue workers), then check php -v and Mautic’s System info again to make sure the new version is the one actually in use. A quick look at your cron jobs and a test email is a nice final check.
If you use packages from your Linux distribution or a third party repository, it can take a little while for updated packages to appear, so keep an eye on your usual source.
Mautic will release updated Docker builds just as soon as the upstream PHP images are available – it may take some time for them to build, we will share updates via the Docker channel on Slack.
Need a hand?
If you’re stuck, please do ask in the Mautic forum or in our community Slack, and if you’d rather someone else took care of it, the Mautic partners directory is a great place to find help.
Thank you for keeping your Mautic instances (and the contacts whose data lives in them!) safe. Looking after our own infrastructure is a big part of what makes self hosting worth it, and it’s lovely to see our community look out for each other on days like this.
References
PHP Group (2026a) Upcoming critical PHP security release. Available at https://www.php.net/archive/2026.php#2026-10-20-1 (Accessed 21 October 2026).
PHP Group (2026b) [ANNOUNCE] Upcoming critical PHP security release. php.announce mailing list, 20 October. Available at https://news-web.php.net/php.announce/509 (Accessed 21 October 2026).