PHP Security Update and Migration Plan

  • Print
23 Oct 2026
PHP Security Upgrade Plan
Written by Aditi Singh
11
0

Following the discovery of critical vulnerabilities in PHP, uKnowva is preparing to migrate its instances to a fixed PHP version. The objective is to address the identified PHP-level security issues by moving to a version in which the vulnerabilities have been resolved.

The migration is being planned with PHP 8.5.12 as the primary target. PHP 8.5.12 includes fixes for both vulnerabilities discussed in the PHP php2shell Security Advisory (CVE-2026-109618 / CVE-2026-109619).

The plan is to move all uKnowva instances to a fixed PHP version, with the final choice guided by the requirements and challenges encountered during the migration.

Objectives

The primary objectives of this plan are to:

  • Mitigate the immediate risks associated with both PHP vulnerabilities.

  • Migrate all uKnowva instances to a fixed and suitable PHP version.

  • Prioritise PHP 8.5.12 as the primary migration target.

  • Maintain PHP 8.2.35 as an alternative migration path if technical or compatibility challenges prevent the planned move to PHP 8.5.12.

  • Minimise service disruption through compatibility testing, staged deployment, and rollback planning.

  • Maintain appropriate security controls after migration.

Proposed PHP Migration Strategy

The team will follow a phased migration strategy, with PHP 8.5.12 as the preferred target and PHP 8.2.35 as the fallback option.

Migration Parameter

Planned Approach

Scope

All uKnowva instances

Primary target

PHP 8.5.12

Alternative target

PHP 8.2.35

Immediate priority

Apply temporary security mitigations and prepare the migration

Primary migration approach

Compatibility assessment, staging validation, and production rollout

Fallback approach

Move to PHP 8.2.35 if significant challenges prevent migration to PHP 8.5.12

Final objective

Ensure all instances operate on an appropriate PHP version that addresses both vulnerabilities

Both PHP 8.5.12 and PHP 8.2.35 are listed as fixed versions for these vulnerabilities in the current security advisory. The final version selection will depend on compatibility, stability, and deployment readiness.

Conclusion

uKnowva HRMS is committed to addressing the identified PHP vulnerabilities through timely security measures and a planned migration to a fixed PHP version. The focus remains on selecting a suitable version for all uKnowva instances while maintaining security and service stability throughout the transition. Further updates will be shared as the migration plan progresses.

If you have any questions or need additional support, feel free to contact us at This email address is being protected from spambots. You need JavaScript enabled to view it..

Was this Article helpful?