Two critical security vulnerabilities affecting PHP were disclosed today, October 21, 2026. These vulnerabilities could allow attackers to execute malicious code on affected servers without authentication.
Matomo Cloud customers are already protected. No action is required.
Matomo On-Premise users should update their PHP installation immediately.
What happened?
The PHP security team has disclosed two critical vulnerabilities, both rated 9.2 out of 10 on the CVSS severity scale:
- CVE-2026-109618: A memory corruption vulnerability related to PHP’s out-of-memory handling.
- CVE-2026-109619: A vulnerability involving PHP’s internal state management that can lead to unsafe memory access.
Under certain conditions, these vulnerabilities could allow unauthenticated attackers to execute code remotely on affected servers.
The vulnerabilities affect PHP itself, rather than Matomo specifically. However, because Matomo runs on PHP, installations using vulnerable PHP versions may be exposed.
Matomo Cloud customers are protected
If you’re using Matomo Cloud, no action is needed.
Our Cloud infrastructure is already protected against these vulnerabilities, and our team manages the underlying infrastructure and security updates on your behalf.
This is one of the benefits of using Matomo Cloud: critical infrastructure security updates are handled for you, without needing to monitor PHP releases or maintain your own servers.
Action required for Matomo On-Premise users
If you host Matomo on your own servers, we strongly recommend updating PHP immediately.
The PHP team has released the following security updates:
| PHP version | Security update |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
If you’re running an older PHP version, check with your operating system or hosting provider for available security patches, or upgrade to a supported version.
We recommend that you:
- Check which PHP version your Matomo server is running.
- Apply the latest security updates from PHP or your operating system vendor immediately.
- Verify that your web server is running the patched PHP version.
Updating Matomo itself does not resolve these vulnerabilities. The security fixes need to be applied to the underlying PHP installation.
For more information, refer to the official PHP security advisory.
Keeping your analytics secure
Security is a priority at Matomo, and we encourage all On-Premise users to keep their infrastructure and software dependencies up to date.
If you’d prefer not to manage server maintenance, PHP upgrades and infrastructure security yourself, Matomo Cloud provides a fully managed alternative, allowing you to focus on your analytics instead.
We’ll continue monitoring developments and share further guidance if needed.
