Recent advisories: check what applies before making changes.

PHP: critical security releases, 21 October 2026

PHP announced fixes for remote-code-execution vulnerabilities CVE-2026-109618 and CVE-2026-109619 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Read the official PHP release announcement.

Those release numbers are not a blanket assurance of safety. PHP’s subsequent guidance on 23 October warns about CVE-2026-115560 in unusual session-serializer configurations, and Windows builds were updated on 26 October for Brotli CVE-2026-111497. Check current supplier guidance, the actual deployed build and configuration, rather than assuming the first update resolves every issue. Read PHP’s October announcements and follow-up guidance.

Django: HTTP-header parsing, 6 October 2026

Django’s security releases 6.1.2, 6.0.9 and 5.2.18 address CVE-2026-84429, a denial-of-service issue in HTTP-header parsing. Django is a Python web framework; this advisory is not a claim that Python applications generally are affected. Read the official Django security release and applicability details.

What this means for your business

These advisories are a reason to check, not evidence that your business is vulnerable, compromised or targeted. We have not established affected versions or configurations for your systems. A proposed review would match authorised evidence of your deployed software to the relevant advisory and explain the next step for you or your developer.

AI integrations can be reviewed separately for documented permissions, connections and data flows. No named AI incident or finding about your tools is claimed on this page.

A free starting point

The free initial check covers observation of one public page. We will flag a specific issue if we find one and explain whether a more detailed review would be useful. It is not a full audit, a guaranteed finding, private runtime verification, scanning or a system change. Public-page observation cannot establish whether a backend CVE applies; that requires separately agreed deployed-software and configuration evidence.

Evidence triage, not remediation

Identify exact assets, ownership, deployed builds and configuration, relevant official advisories and effective permissions. Record action justified, no action justified from available evidence, or unresolved. Technology names and missing evidence are not vulnerability findings.

Changes need separate agreement

Name the intended result, competent implementer, prerequisites, tests, backups and rollback. Updates need deployed before-and-after evidence; removal needs dependency and revocation checks; restrictions need required operations to succeed and prohibited operations to be blocked. An evidence request or settings screenshot is not a verified fix.

Review boundaries

Evidence-only work permits no scanning, endpoint enumeration, crafted payloads, account access, dependency resolution or installation, or live changes. No penetration testing, incident response, certification or overall-security guarantee is offered.

Earlier service information

The earlier accessibility offers are retained for reference, not open for booking. Read the service terms.