和 Codex 说: 晚安宝贝🌙

某个 vps 商家给我发了一封信，内容如下:

Advance notice: Critical security vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

Dear customer,

We would like to give you advance notice of two critical security vulnerabilities in PHP, tracked by the PHP security community as CVE-2026-109618 and CVE-2026-109619. Based on current information, both allow the execution of malicious code on affected systems (remote code execution) and have been rated by the PHP Security Team with a severity of “critical” (CVSS v4.0: 9.2).

Current status

The official security update will be released today, 21 October 2026, at 14:00 UTC (16:00 CEST). The PHP project reserves the right to release the update earlier should details of the vulnerabilities become public or should active exploitation be observed. Confirmed details on affected versions and the root cause will only be available with the release. Official patches are expected only for currently supported PHP versions (8.2 and newer). No official fix is expected for older versions.

The official advance notice from the PHP project is available here: https://www.php.net/archive/2026.php#2026-10-20-1

Who is affected?

Potentially all systems running PHP, regardless of which product you use with us (Webhosting, Managed Server, Managed Cloud Cluster, Root Server, VPS). Patching is only possible at the level of the PHP installation itself, not within the application.

What we are doing (Webhosting, Managed Server)

Based on the information currently available, we are preparing configuration and hardening measures and will verify them against the official details once the patch has been released. As soon as the official patch is available, we will roll it out automatically on all affected systems. For older PHP versions for which no official patch will be released, we will develop and apply a patch ourselves. No action is required on your part.

What you should do (Root Server, VPS, Managed Cloud Cluster)

For Root Servers, VPS and the VMs on Managed Cloud Clusters, patching is your responsibility. We strongly recommend the following:

Check now which PHP versions are in use on your systems.

Plan to apply the official update immediately after its release. Attack attempts are to be expected shortly after the patch becomes public.

If you are using a PHP version for which no official patch will be released: it is currently not foreseeable when a patch for older PHP versions will become available through unofficial channels (such as distribution backports). Therefore, verify your application’s compatibility with a supported PHP version and prepare the upgrade.

帮我依次检查一下我名下的 vps，分析一下哪些需要更新这两个安全补丁的，把 vps 名单列出来告知我。