Emergency PHP security update (CVE-2026-109618 / CVE-2026-109619)
Auswirkung: ErheblichAktueller Status: Behoben
Begonnen · Behoben am On October 21, 2026, the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP’s core. Left unpatched, these flaws could allow an unauthenticated attacker to execute code remotely on affected servers. Germany’s Federal Office for Information Security (BSI) also issued a warning and urged operators to patch immediately.
We updated PHP across our web hosting platform to the fixed releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and both vulnerabilities are now closed for our web hosting customers. This was an emergency security update, not a service disruption, and no action is required from customers hosted on our platform.
If you run PHP applications outside our infrastructure, we recommend updating to a fixed release as soon as possible.Betroffene Dienste: Hosting Services
We updated PHP across our web hosting platform to the fixed releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and both vulnerabilities are now closed for our web hosting customers. This was an emergency security update, not a service disruption, and no action is required from customers hosted on our platform.
If you run PHP applications outside our infrastructure, we recommend updating to a fixed release as soon as possible.Betroffene Dienste: Hosting Services
Referenzen
- PHP release announcement
- https://www.php.net/archive/2026.php#2026-10-21-5
- BSI Security Advisory (German)
- https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.pdf?__blob=publicationFile&v=3
- EU-CERT Security Advisory
- https://cert.europa.eu/publications/security-advisories/2026-018
- NSA Security Advisory
- https://www.nsa.gov/press-room/press-releases-statements/press-release-view/article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/