mailwal

Critical PHP security release coming today at 2pm UTC

Sīlavāpi at Mautic

Urgent PHP security release today

Hi John,

I wanted to get this to you quickly. Last night the PHP security team announced a security release for today, Wednesday 21 October, at 14:00 UTC (3pm UK time). It fixes two critical vulnerabilities, both rated 9.2 under CVSS v4.0, and Mautic runs on PHP, so if you host your own instance this one matters.

PHP will publish the affected and fixed versions with the release, so for now the best thing is to get ready.

  1. Check which PHP version your Mautic server uses (Settings, then System info in Mautic, or php -v on the server).
  2. Make sure your PHP branch is still supported on the PHP supported versions page. End of life branches may never get this fix.
  3. If a host or agency manages your server, ask them today when they'll apply the update.
  4. Take a fresh backup of your instance and your server, and block out some time to update as soon as the release is out.

Everything is in our blog post, which we'll update with the fixed versions this afternoon.

Read the full guidance on the Mautic blog

If you get stuck, the Mautic forum is full of lovely folks happy to help!

Sīlavāpi