Drupal Association blog: After the PHP security release: auditing your Drupal sites

First things first: if you have not yet updated PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your host’s or distribution’s patched build), do that right away. See PSA-2026-10-20 from the Drupal Security Team and the PHP project’s security advisory . Updating is the only complete fix for CVE-2026-109618 and CVE-2026-109619, and a configuration change or web application firewall rule does not replace it.