Keeping your FileMaker Server and web tools up to date is one of the simplest ways to protect your business data. This week gives every FileMaker team a compelling reason to inspect their systems. On October 21, 2026, the PHP project released critical fixes for two high-severity vulnerabilities (each rated 9.2 out of 10), prompting CERT-EU to issue Security Advisory 2026-018 with an urgent call to patch immediately.
Claris stopped bundling PHP with FileMaker Server several versions ago, making it easy to assume this advisory doesn’t apply to your stack. In practice, legacy PHP components often linger on servers long after their initial installation, and many custom FileMaker solutions rely on PHP-driven websites or API webhooks to exchange data with the web.
Here’s how to audit your deployment and secure your environment.
Step 1: Determine If PHP Is Running on Your FileMaker Server
Platform architecture and historic upgrade paths dictate whether PHP is currently installed on your server machine:
- macOS: FileMaker Server 19.3.3 was the final version to ship with bundled PHP. While clean installs of FileMaker Server 19.4.1 and newer don’t provide it, standard in-place upgrades don’t automatically remove existing PHP installations.
- Windows: FileMaker Server 19.1.2 was the last bundled release. Even though 19.2.1+ required an uninstallation step, many admin teams manually backed up and restored the legacy PHP directory to preserve custom web tools. Standalone PHP modules running under IIS also remain active unless manually removed.
- Linux: FileMaker Server for Linux never bundled PHP; audit only for standalone packages installed via apt, yum, or custom scripts.
Step 2: Audit Connected Web Applications & Integrations
FileMaker data often flows through external web endpoints rather than direct client connections. PHP may still pose a security risk across your broader technology infrastructure if you utilize:
- Custom Web Publishing (CWP): Older sites leveraging Claris CWP often run on end-of-life PHP environments that no longer receive standard vendor security patches.
- Web portals and forms: Custom customer portals or web forms that push/pull FileMaker data via PHP endpoints.
- WordPress sites: WordPress installations with custom integrations or plugins communicating with your FileMaker database.
- Webhook receivers: Lightweight background scripts receiving third-party API notifications (such as payment gateway callbacks) and writing them into FileMaker.
Step 3: Actionable Security Checklist
Follow this four-point remediation path to secure your infrastructure:
- Conduct a technology inventory: Catalog every web-connected server interacting with your FileMaker databases. Verify PHP status and public accessibility across both application servers and external web hosts.
- Apply security patches: Update standalone PHP environments to fixed releases (8.5.12, 8.4.27, 8.3.36, or 8.2.35). Use official distribution package managers on Linux or vendor-approved installers on Windows and macOS.
- Address legacy runtime dependencies: If core web solutions require legacy runtimes (PHP 8.1, 8.0, or 7.4), coordinate with your OS vendor for backported security patches or compile source-level fixes. Restrict public access via VPN or IP whitelisting until patching is complete.
- Implement mitigation stopgaps: Apply CERT-EU temporary hardening configurations—such as disabling session upload progress tracking and tightening maximum request sizes—to lower exposure while scheduling maintenance windows.
Secure Your FileMaker Infrastructure
With active exploit details in circulation, unpatched PHP components expose your business data to unnecessary risk. A quick server audit and patch cycle ensures your FileMaker environment remains secure, resilient, and performant.
- Need expert assistance evaluating your environment? Request a FileMaker Health Check. Our certified solution engineers will audit your FileMaker Server architecture, connected web tools, and security configuration to deliver a clear mitigation roadmap.
- Ready to patch today? Contact the LuminFire engineering team to schedule server maintenance, apply security updates, or modernize legacy CWP web apps with modern, secure integration patterns.
The LuminFire team is an elite group of software developers, engineers, and technology leaders with nearly 40 years of industry know-how. Passionate about empowering growth-focused organizations, the team is dedicated to removing technical obstacles and sharing insights to help businesses become more effective, productive, and profitable.