PHP Security Notice: Update Your ClientXCMS Server
· 4 min read
On October 21, 2026, the PHP project released security fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2/10 under CVSS v4.0.
These vulnerabilities may allow an unauthenticated attacker to execute remote code on a server running a vulnerable PHP version. PHP installations serving web requests may be affected, including PHP-FPM, Apache with mod_php, PHP-CGI, FrankenPHP, and LiteSpeed.
This is not a ClientXCMS vulnerability
These vulnerabilities affect the PHP runtime, not ClientXCMS itself. A ClientXCMS instance can nevertheless be exposed when it runs on an affected PHP version, just like any other PHP application.
