New OkayCMS 4.5.3 Release: PHP 8.3 and PHP 8.5 Security Updates
- What changed in PHP
- Why we released OkayCMS 4.5.3
- Which PHP versions are recommended
- Why both OkayCMS and PHP need to be updated
- What store owners need to do
- What to check after the update
- Why you should move to a modern PHP version
- How to check your PHP version and what to do if the update is not yet available
- Official information about the update
- Need help updating OkayCMS?
On October 21, 2026, the PHP team released important security updates that address two critical vulnerabilities in the server environment. OkayCMS users are advised to check their current PHP version and upgrade to an up-to-date patched release.
To ensure that OkayCMS users would not have to wait for the next major system release, we released OkayCMS 4.5.3 with the changes required to run on current versions of PHP 8.3 and PHP 8.5.
Important: the identified vulnerabilities are in PHP itself, not in OkayCMS. Updating the CMS alone is therefore not enough to protect an online store - a patched PHP version must also be used.
What changed in PHP
The PHP team published fixes for two critical vulnerabilities - CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they may allow remote code execution without prior authentication.
To address these vulnerabilities, PHP 8.2.35, PHP 8.3.36, PHP 8.4.27 and PHP 8.5.12 were released. For current OkayCMS versions, we recommend using PHP 8.3 or PHP 8.5.
Why we released OkayCMS 4.5.3
Support for modern PHP versions was already part of the technical transition the team has been working on while preparing future OkayCMS releases.
However, after the important PHP security updates were released, we decided not to wait for the next major OkayCMS release. The changes required to run the system on PHP 8.3 and PHP 8.5 were therefore included in a separate OkayCMS 4.5.3 update.
This means users can update OkayCMS and move to a patched PHP version now, without waiting for OkayCMS 4.6.0.
Which PHP versions are recommended
For websites running OkayCMS 4.5.3, we recommend using:
- PHP 8.3.36 or a newer PHP 8.3 release;
- PHP 8.5.12 or a newer PHP 8.5 release.
If your hosting provider already offers a newer patch release within PHP 8.3 or PHP 8.5 that includes the latest security fixes, we recommend using that version.
Why both OkayCMS and PHP need to be updated
Because the vulnerabilities are located at the PHP level, updating OkayCMS alone does not resolve the issue in the server environment.
A safe transition therefore requires two main steps:
- update the website to OkayCMS 4.5.3;
- move it to an up-to-date patched version of PHP 8.3 or PHP 8.5.
What store owners need to do
We recommend performing the update in the following order:
- Create a backup of the website files and database.
- Update OkayCMS to version 4.5.3.
- In your hosting control panel, check the available PHP 8.3 or PHP 8.5 version and make sure it is PHP 8.3.36 / PHP 8.5.12 or a newer patched release.
- Switch the website to the selected current PHP version.
- Check the website, order placement, installed modules and integrations.
Please note: all installed modules that are not included in the standard OkayCMS package must be updated to their latest available versions. This includes modules from the OkayCMS Marketplace, partner solutions, and any other additionally installed modules. Before switching to PHP 8.3 or PHP 8.5, make sure that their current versions are compatible with the selected PHP version.
If your website uses custom-developed modules or other custom modifications, they should also be checked separately and adapted to the new PHP version where necessary.
What to check after the update
After changing the PHP version, check the main online store workflows:
- the home page and product catalog;
- category and product pages;
- product search and filtering;
- adding products to the cart;
- checkout and order placement;
- payment and delivery methods;
- the version status and operation of all modules that are not included in the standard OkayCMS package;
- custom modifications and integrations;
- the OkayCMS administration panel.
If the website is integrated with a CRM, delivery services, payment systems, or uses automated data import or export, these workflows should also be tested separately.
Why you should move to a modern PHP version
PHP 7.4 has already reached the end of its official support cycle and no longer receives security updates from the PHP Project. Some operating system vendors and LTS providers may issue their own backported fixes, but this does not return PHP 7.4 to the official PHP support cycle.
For production online stores, we recommend using a currently supported PHP version. For OkayCMS 4.5.3, the recommended options are PHP 8.3 and PHP 8.5.
How to check your PHP version and what to do if the update is not yet available
After updating OkayCMS to version 4.5.3, check which PHP versions are available from your hosting provider.
For OkayCMS 4.5.3, we recommend using:
- PHP 8.3.36 or a newer PHP 8.3 release;
- PHP 8.5.12 or a newer PHP 8.5 release.
Log in to your hosting control panel, find the PHP settings for your website, and check which versions are available.
If PHP 8.3.36, PHP 8.5.12, or a newer version is already available, select it and save the changes.
After that, make sure your website is actually running on the new PHP version.
To check this, open the OkayCMS administration panel and go to:
Website Settings → System Information
This section shows the currently active PHP version used by your online store.
Pay attention to the full version number. For example, PHP 8.3.35 and PHP 8.3.36 are different releases. To address the vulnerabilities described above, you need PHP 8.3.36 or a newer version.
If the required PHP version is not yet available in your hosting control panel, you do not need to install anything manually. Contact your hosting provider and ask when an up-to-date PHP version containing the necessary security fixes will become available.
Once the required version becomes available, switch your website to it and then check the active PHP version again under Website Settings → System Information.
Official information about the update
Detailed technical information about CVE-2026-109618 and CVE-2026-109619, patched PHP releases and support timelines is available in the official PHP resources:
- PHP Security Advisory from October 21, 2026;
- PHP 8.3.36 Release Announcement;
- PHP 8.5.12 Release Announcement;
- current PHP versions and their support timelines.
Need help updating OkayCMS?
If you are unsure whether your installed modules, template or custom modifications are compatible with the new PHP version, the OkayCMS team can help you check and update your project.
Create a request with OkayCMS technical support. We will review your current system version, installed modules and the specific configuration of your online store and help you complete the update.