Security advisory · October 22, 2026
Important PHP Security Update for Watch My Domains SED
On October 21, 2026, the PHP project disclosed two critical security vulnerabilities and released fixes. These vulnerabilities are in PHP itself, not in Watch My Domains SED. Customers running SED on their own servers need to update PHP.
Self-hosted: Install a security-patched PHP version compatible with your SED installation.
Managed Edition: PHP updates are handled by us; please still verify your installed PHP version. All customers: Open /verify.php in your SED installation and review PHP Version.
What happened?
The PHP security team announced fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. PHP installations serving web requests can be affected, regardless of which PHP application is running.
Updating Watch My Domains SED alone does not resolve the PHP vulnerabilities. You need a PHP release containing the security fixes. See the official PHP security advisory for technical details.
Which PHP releases contain the fixes?
| PHP branch | Minimum patched release (October 21, 2026) |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Use the listed version or a later security-maintained release in the same branch. Merely running “PHP 8.2” or “PHP 8.3” does not guarantee that your PHP is patched. PHP 8.1 and older branches are not an appropriate solution to this security issue.
Planning ahead: PHP 8.2 reaches end of life on December 31, 2026. If you are choosing a long-term PHP version, consider a newer supported branch that your SED edition can run.
Which Watch My Domains SED version do I need?
| Your SED installation | What to do |
|---|---|
| Older than v5 | Upgrade to v6 to use a supported, patched PHP branch. Older SED versions do not support PHP 8.2 or later. |
| v5, latest update | You can stay on v5 with patched PHP 8.2.35+ or 8.3.36+. A v6 purchase is not required solely for this PHP security issue. |
| v6 | Keep your current SED application version and update the server to a patched, compatible PHP release (including PHP 8.4.27+). |
| v6 with PHP 8.5 | PHP 8.5 compatibility is available on request with a minor SED application change. Contact support before switching. |
| Managed Edition | Our team handles PHP updates and has already migrated customers running older versions of Watch My Domains SED to the latest v6. You do not need to update the server yourself; please verify the installed PHP version as described below. |
For v5 Standard and Basic Editions, support for PHP 8.2 and 8.3 was added in the November 22, 2024 update. The v5 Professional Edition already supported those branches. Check the v5 version history if you are unsure whether your v5 installation is up to date.
Upgrading to v6 is recommended for broader PHP compatibility and ongoing product improvements, but existing up-to-date v5 installations do not need to purchase v6 merely to apply these PHP fixes.
How do I check my server?
In a browser, open /verify.php in your Watch My Domains SED installation (for example, https://your-sed-host.example/verify.php). Locate the PHP Version section and compare the version with the table above.
Check the PHP version reported by the web application, not only the version returned by php -v on the command line: a server can have more than one PHP version installed.
Self-hosted customers: If PHP is not patched, update your server's PHP packages or ask your hosting administrator to do so. Confirm your SED version supports the target PHP branch, then revisit /verify.php after the update.
Managed Edition customers: Your installations are already covered by our managed infrastructure updates. We still recommend checking /verify.php. If the displayed PHP version is not patched, contact us rather than updating the managed server yourself.
Upgrade, download, and support
Need a newer SED release, installation instructions, or help confirming PHP compatibility? Use the resources below. Existing up-to-date v5 users can apply the PHP fixes without purchasing v6.
