Keeping your FileMaker Server and web tools up to date is one of the simplest ways to protect your data, and this week gives every FileMaker team a good reason to check their systems. On October 21, 2026, the PHP project released fixes for two critical vulnerabilities, each rated 9.2 out of 10, and CERT-EU followed with Security Advisory 2026-018, urging organizations to patch immediately.
Claris stopped bundling PHP with FileMaker Server several versions ago, so it is easy to assume this news does not apply to you. In practice, PHP often stays on a server long after anyone remembers installing it, and many FileMaker solutions still use PHP-based websites and tools to share data with the web. Below, we walk through how to determine whether your deployment is affected and how to secure it.
Does PHP Still Run on Your FileMaker Server?
Start with the server itself. Whether PHP is still there depends on your platform and how your server reached its current version:
macOS: FileMaker Server 19.3.3 was the last version to include PHP. Starting with 19.4.1, new installations no longer provide it, but upgrades do not remove an existing copy, so a server that started on 19.3.3 or earlier may still have PHP installed.
Windows: FileMaker Server 19.1.2 was the last version to include PHP; 19.2.1 and later no longer install it. Because that upgrade required uninstalling the previous version, many teams backed up their PHP folder and restored it afterward. PHP installed separately under IIS also stays in place.
Linux: FileMaker Server for Linux never included PHP, so check only for copies someone installed separately.
Next, look beyond the server itself. Customers and staff often access FileMaker data through a website rather than opening FileMaker directly, and many of those websites run PHP behind the scenes. That means PHP can still be part of your setup even when your FileMaker Server is clean.
If you have any of these, check whether they run on PHP:
An older website built with Claris's original web publishing tools, known as Custom Web Publishing
Online forms or customer portals that display or save FileMaker data
A WordPress site that pulls information from FileMaker or sends information to it
Small background programs that receive updates from other services, such as a payment confirmation, and pass that information into FileMaker
Not sure what is in place? Ask whoever built or hosts your website. Older Custom Web Publishing sites deserve a close look, since they often run older versions of PHP that no longer receive regular security updates.
How to Secure Your Servers
Start with these four steps to secure your FileMaker data:
Take inventory. List every server that touches your FileMaker data over the web, including the FileMaker Server machine and any separate web or WordPress hosts, and confirm whether PHP is installed and reachable from the internet.
Update PHP. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. On Linux hosts, your distribution’s package updates are usually the fastest route. On Windows and macOS, update PHP from the same source it was originally installed from.
Plan for older PHP versions. If a legacy site depends on PHP 8.1, 8.0, or 7.4, ask your OS vendor about patched packages. The PHP team has also released source-level fixes for those versions. Until the server is patched, limit access to trusted networks, for example, through a VPN.
Use stopgaps only as a bridge. CERT-EU lists configuration changes that reduce risk while you schedule an update, such as disabling session upload progress and reducing the maximum request size. They narrow exposure but do not replace the update.
Don't Wait, Update
Two critical PHP vulnerabilities, publicly leaked details, and PHP that may still run on your FileMaker Server or connected websites all point to one clear step: check your servers and update today. A quick inventory and patch now keeps your FileMaker data protected and your web tools running with confidence.
Want an expert set of eyes on your setup? Request a complimentary FileMaker Health Check, and our FileMaker experts will review your application and server configuration, then recommend the right next steps to keep your system secure.
Ready to update now? Contact our team, and we will help you check your FileMaker Server and connected web tools for PHP, apply the right updates, and plan any upgrades your solution needs.
Did you know we are an authorized reseller for Claris FileMaker Licensing?
Contact us to discuss upgrading your Claris FileMaker software.
