In short
- If you use our hosted service, you are safe. The patch was deployed at 15:05 UTC today, and there is nothing for you to do.
- If you self-host the open-source version of WorkAdventure, you are not affected: it does not use PHP.
- If you self-host the WorkAdventure admin panel, we have notified you directly, an updated image is available and must be deployed.
Today, the PHP project published fixes for two critical vulnerabilities. Both can lead to remote code execution on the server, and both are rated 9.2 out of 10 (CVSS v4.0). The details are in the PHP security advisory:
- CVE-2026-109618: when PHP runs out of memory, it can be interrupted while internal request data is only partially set up, and the cleanup that follows may treat that data as valid.
- CVE-2026-109619: internal state belonging to one request can survive after its memory is freed, and a later request on the same worker may use it.
They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released at the same time, at 14:00 UTC.
Why WorkAdventure was concerned at all
Most of WorkAdventure runs on Node.js: the map, the video, the chat, everything your browser talks to while you walk around. One part does not. The admin panel, the dashboard where you manage your WorkAdventure spaces, has a PHP backend. That backend needed the upgrade.
What we did
PHP gave everyone a day’s notice: on October 20th, it announced that a critical security release would land on the 21st at 14:00 UTC. We knew exactly when the fix would arrive, so at 14:00 UTC, we were ready to rebuild.
Our admin panel does not install PHP by itself. It sits at the end of a chain:
- 14:00 UTC: the PHP project publishes the patched releases.
- Minutes later: the patched packages are available on Ondřej Surý’s repository, which many Debian and Ubuntu servers rely on for up-to-date PHP versions.
- We rebuild the thecodingmachine/php Docker images, which our admin panel is built on.
- We rebuild the admin panel on top of the new images.
- 14:55 UTC: the patched admin panel is tested in staging environment.
- 15:05 UTC: the patched admin panel is in production.
Our build processes are fully automated, so the only time we spent was waiting for the upstream packages to be available. The result:
65 minutes from the PHP release to production 🚀. That speed is not our doing alone: every link of the chain was ready before we needed it.
Without interrupting anyone
The deployment was a rolling upgrade: containers running the patched PHP started alongside the old ones and took over the traffic, and only then were the old ones stopped. Nobody using the admin panel was interrupted.
PHP makes this easy, thanks to its “shared nothing” architecture. Every request starts from a clean slate, and nothing stays in the PHP process once the request is over: whatever must last longer lives in the database or a shared store. So one request can be answered by an old container and the next one by a new container, and the user never notices. There is nothing in memory to drain, move or rebuild before switching.
Who is concerned
| Affected? | What you have to do | |
|---|---|---|
| Hosted service (workadventu.re) | Patched at 15:05 UTC on October 21st, 2026. | Nothing. |
| Self-hosted WorkAdventure (open source) | No. It does not contain PHP. | Nothing. |
| Self-hosted admin panel | Yes, until upgraded. | We have notified you and a new admin panel version is available. |
Expect more of these
We do not think today will be an exception. AI agents are getting good at finding security flaws: they can read a large codebase, come up with a theory and test it much faster than a person can, and they never get tired of checking one more edge case. Security researchers use them. So do attackers.
The result is more vulnerabilities found, in more projects, in less time. For maintainers, that means more security releases, announced a day or less in advance. We expect releases like today’s to happen regularly in the coming months, in PHP and in everything else we build on: Node.js, the libraries we depend on, and WorkAdventure itself.
It also changes what “patched quickly” has to mean. Once a fix is public, it shows attackers where the hole was, and the same AI tools can help them turn it into a working attack faster than before. So rebuilding, testing and deploying within the hour, as we did today, might become regular.
If you self-host WorkAdventure, plan for it too: keep your upgrade procedure short and practised, and set SECURITY_EMAIL in your configuration so that we can reach you directly when a release concerns your version.
Thanks
A fix like this one only reaches production fast when everybody upstream did their part well. So, thank you:
- to the PHP contributors who found, fixed and coordinated these vulnerabilities, and announced the release a day ahead so that everyone could get ready;
- to Ondřej Surý, whose packages were available almost as soon as the release was out, as they have been for years;
- to the maintainers of the thecodingmachine/php images;
- and to everyone else in the chain who made this a coordinated release rather than a scramble.