Feng Office Security alert: critical PHP vulnerabilities announced on October 21st, 2026
Today, October 21, 2026, PHP (The main programming language used by Feng Office) published a security advisory on two critical vulnerabilities. Both can allow remote code execution without authentication. The PHP security team states: “All PHP users are strongly encouraged to update immediately.”
What we have done
- We updated all of our servers and libraries to PHP 8.4.27, which includes the fix.
- Released a new stable Feng Office package for on-premise installations.
- Our support team is supporting all on-premise clients to upgrade installations and infrastructure.
Cloud customers: no action is needed. Your service is already protected.
On-premise clientsYour protection depends on the PHP version running on your server. The versions issued today by the PHP team that are considered safe are PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
PHP 8.1 and older no longer receive updates from the PHP project.
Running PHP 8.2 or later requires Feng Office 3.11.11 or later.
In summary, you are strongly encouraged to:
- Install the latest stable version of Feng Office
- Update PHP to a safe version.
If you need help, our technical support team is here to help you.
System administrators can find the full technical details in the PHP security advisory.
Your internal policiesPlease also review your internal security policies, including server patching, access control, and backups.For questions or to schedule assistance for your upgrade, you can contact us here.
