# Action Needed to Patch PHP **URL:** \ **Category:** Using Concrete / Help\ **Created:** [October 21, 2026, 4:01pm UTC](https://forums.concretecms.org/t/action-needed-to-patch-php/10099 "2026-10-21T16:01:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![AbschAdmin](https://forums.concretecms.org/user_avatar/forums.concretecms.org/abschadmin/32/5178_2.png) [@AbschAdmin](https://forums.concretecms.org/u/AbschAdmin)\ **Post date:** [October 21, 2026, 4:01pm UTC](https://forums.concretecms.org/t/action-needed-to-patch-php/10099/1 "2026-10-21T16:01:02Z")
[PHP foundation announced a critical update](https://www.php.net/archive/2026.php#2026-10-20-1) for PHP versions to address major vulnerabilities. Is this something that needs to be implemented on the user end or does Concrete implement these updates? Our website is hosted at Portland Lab servers and is running on PHP 8.2.34. ---
**Author:** ![AbschAdmin](https://forums.concretecms.org/user_avatar/forums.concretecms.org/abschadmin/32/5178_2.png) [@AbschAdmin](https://forums.concretecms.org/u/AbschAdmin)\ **Post date:** [October 21, 2026, 4:30pm UTC](https://forums.concretecms.org/t/action-needed-to-patch-php/10099/2 "2026-10-21T16:30:20Z")
Heard from support that this is being addressed by Portland Labs and may affect the ability to upload files throughout the day as the patches are applied ---
**Author:** ![mhawke](https://forums.concretecms.org/user_avatar/forums.concretecms.org/mhawke/32/6297_2.png) [@mhawke](https://forums.concretecms.org/u/mhawke)\ **Post date:** [October 21, 2026, 7:40pm UTC](https://forums.concretecms.org/t/action-needed-to-patch-php/10099/3 "2026-10-21T19:40:42Z")
Our Canadian government put out this release about versions that are affected. It suggests that 8.5.12 is fixed but that version has been available on SiteGround for at least 2 weeks because I just updated a site and put it on the newest version which was 8.5.12. Any thoughts on this? | Affected Versions | Fixed Versions | | 8.5.x prior to 8.5.12 | 8.5.12 | | 8.4.x prior to 8.4.27 | 8.4.27 | | 8.3.x prior to 8.3.36 | 8.3.36 | | 8.2.x prior to 8.2.35 | 8.2.35 | ---
**Author:** ![mhawke](https://forums.concretecms.org/user_avatar/forums.concretecms.org/mhawke/32/6297_2.png) [@mhawke](https://forums.concretecms.org/u/mhawke)\ **Post date:** [October 21, 2026, 8:22pm UTC](https://forums.concretecms.org/t/action-needed-to-patch-php/10099/4 "2026-10-21T20:22:23Z")
Apparently, SiteGround fixed their version ahead of the public announcement. [SiteGround moves early to protect customers ahead of critical PHP security release](https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026) ---
**Author:** ![AbschAdmin](https://forums.concretecms.org/user_avatar/forums.concretecms.org/abschadmin/32/5178_2.png) [@AbschAdmin](https://forums.concretecms.org/u/AbschAdmin)\ **Post date:** [October 21, 2026, 9:11pm UTC](https://forums.concretecms.org/t/action-needed-to-patch-php/10099/5 "2026-10-21T21:11:49Z")
This all tracks with the info I have been able to find, hacker news (who first published the issue) has the same chart with Affected Versions vs Fixed Versions as well as tips on spotting errors that may suggest a server has been infiltrated. [PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html) ---
**Author:** ![littlerock](https://forums.concretecms.org/user_avatar/forums.concretecms.org/littlerock/32/6302_2.png) [@littlerock](https://forums.concretecms.org/u/littlerock)\ **Post date:** [October 28, 2026, 3:49pm UTC](https://forums.concretecms.org/t/action-needed-to-patch-php/10099/6 "2026-10-28T15:49:26Z")
> [@AbschAdmin](#): > > [PHP foundation announced a critical update](https://www.php.net/archive/2026.php#2026-10-20-1) for PHP versions to address major vulnerabilities. Is this something that needs to be implemented on the user end or does Concrete implement these updates? > > Our website is hosted at Portland Lab servers and is running on PHP 8.2.34. This update needs to be applied at the **server/PHP level rather than through Concrete CMS itself**. Since your site is hosted on PortlandLabs’ servers, they would be responsible for updating the PHP installation on the hosting environment. PHP 8.2.34 is one of the affected versions, and PHP 8.2.35 contains the security fixes for the two critical vulnerabilities. One additional consideration is that PHP 8.2 reaches end of security support at the end of 2026. If your version of Concrete supports it, it would also be worth planning a move to PHP 8.3 or newer rather than remaining on 8.2 long term. ---
**Author:** ![AbschAdmin](https://forums.concretecms.org/user_avatar/forums.concretecms.org/abschadmin/32/5178_2.png) [@AbschAdmin](https://forums.concretecms.org/u/AbschAdmin)\ **Post date:** [October 28, 2026, 4:02pm UTC](https://forums.concretecms.org/t/action-needed-to-patch-php/10099/7 "2026-10-28T16:02:44Z")
We were able to confirm with Portland Labs that we are now running on 8.2.35. We’ll have to confirm the switch to 8.3 or newer by end of year, thanks for the tip