VoIPstudio's platform is now fully patched against the two critical PHP vulnerabilities disclosed this week. There was no downtime to calls, the API or any other service, and customers don't need to do anything.
On 21 October the PHP project released emergency fixes for two serious flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is the programming language behind roughly 70% of websites whose underlying technology is known, so millions of websites and countless businesses worldwide are exposed. Both flaws are rated critical because they could let an attacker run their own code on an unpatched web server without logging in. Security researchers had already seen attackers probing for them before the fixes were even published, which is why the advice across the industry has been to patch immediately rather than wait for a normal update cycle.
That's what we did. Our engineering team rolled out the fix across the platform as soon as it was available on 21st October, without interrupting service. Calls, the VoIPstudio apps, the API and integrations kept running throughout, and we're continuing to monitor closely.
There is nothing you need to change on your VoIPstudio account. If your business runs its own website or web applications on PHP, it's worth checking with your web host or developer that they've moved to one of the fixed versions (8.5.12, 8.4.27, 8.3.36 or 8.2.35). Older versions of PHP are affected too but won't receive a fix, so if you're still running one, now is the time to upgrade.
If you have any questions about VoIPstudio's response, our support team is happy to help.
