# Upgrade 9.5.7 and PHP Security (CVE-2026-109618 and CVE-2026-109619)

**URL:** <https://forums.concretecms.org/t/upgrade-9-5-7-and-php-security-cve-2026-109618-and-cve-2026-109619/10100>\
**Category:** Community Talk\
**Created:** [October 21, 2026, 4:05pm UTC](https://forums.concretecms.org/t/upgrade-9-5-7-and-php-security-cve-2026-109618-and-cve-2026-109619/10100 "2026-10-21T16:05:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![BT\_AV](https://forums.concretecms.org/user_avatar/forums.concretecms.org/bt_av/32/6231_2.png) [@BT\_AV](https://forums.concretecms.org/u/BT_AV)\
**Post date:** [October 21, 2026, 4:05pm UTC](https://forums.concretecms.org/t/upgrade-9-5-7-and-php-security-cve-2026-109618-and-cve-2026-109619/10100/1 "2026-10-21T16:05:27Z")

</div>

Are these two vulnerabilities addressed in the latest update?

---

<div class="post-metadata">

**Author:** ![mlocati](https://forums.concretecms.org/user_avatar/forums.concretecms.org/mlocati/32/6208_2.png) [@mlocati](https://forums.concretecms.org/u/mlocati)\
**Post date:** [October 22, 2026, 10:33pm UTC](https://forums.concretecms.org/t/upgrade-9-5-7-and-php-security-cve-2026-109618-and-cve-2026-109619/10100/2 "2026-10-22T22:33:59Z")

</div>

These vulnerabilities aren’t application-specific; Concrete can’t do anything about them.

The only way to protect your websites is to update PHP.

---

<div class="post-metadata">

**Author:** ![BT\_AV](https://forums.concretecms.org/user_avatar/forums.concretecms.org/bt_av/32/6231_2.png) [@BT\_AV](https://forums.concretecms.org/u/BT_AV)\
**Post date:** [October 24, 2026, 3:42pm UTC](https://forums.concretecms.org/t/upgrade-9-5-7-and-php-security-cve-2026-109618-and-cve-2026-109619/10100/3 "2026-10-24T15:42:35Z")

</div>

Thanks Michele, I just panicked after client panicked 'cause her websites were down.  
Hosting company fixed it very swiftly.