PHP have announced that they'll be releasing a security fix on 21 October 2026 (today!) at 14:00 UTC. While we don't yet know the details, it appears to be a very high security risk. Naturally, when PHP releases the fix, the exploit itself will become evident, and it is anticipated that there will be a concerted effort from malicious actors to exploit any PHP application that can be found. Habitat is a PHP application, and as such, it would be safe to assume that is is vulnerable to this issue.

I will be making attempts to update Habitat with the security fix as soon as I can. I cannot assure when this will be, so I recommend that your Habitat instance is shut down from 14:00 UTC today until I release the fix.

Also, just as a public service announcement -- if you're hosting any other PHP applications, they'll also be vulnerable.

Just an update here - Cloudflare have announced that they're seeing early attacks against PHP sites. They have updated their WAF for all (paid and unpaid) customers, so if you're using cloudflare, you might be safe, but if you want to be cautious, I'd recommend turning off your PHP applications now and keep an eye out for security updates for those applications.

Habitat has been updated: https://feddit.uk/post/57255152