Critical security vulnerabilities in PHP
What is behind it?
On 21 October 2026, two critical security vulnerabilities in PHP were made public. PHP is an open source scripting language used behind the scenes of many websites and web applications.
The two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect the internal handling of memory and errors in PHP. They have been rated high severity and can have serious consequences under certain conditions.
What measures were taken by us?
Following the release of the security updates, we installed the corresponding patches on 21.10.2026 within one hour across all our systems. This brought the affected PHP components up to the updated security standard. Thanks to our swift action and our security concept, none of our systems were compromised and no website had to be shut down.
What could have happened?
Attackers could exploit the vulnerabilities under certain conditions without having to log on to the affected system first. In the worst case, they could execute their own code on a server and thereby gain control over parts of the system.
Possible consequences would be, for example:
- Data theft: Unauthorised individuals could gain access to confidential information.
- Website tampering: Content could be altered or malware embedded.
- Service outage: Systems could crash or no longer be accessible to users.
- Further attacks: A compromised server could serve as a starting point for additional attacks.
Whether a system is actually vulnerable depends, among other things, on the PHP version used and the respective server configuration.
Why are such updates important?
Security vulnerabilities cannot always be prevented. What is crucial, therefore, is to remedy known weaknesses promptly and keep the software in use up to date. Regular updates are an important part of our work to reduce risks for systems and data. The best protection is therefore the latest PHP version in combination with an up-to-date CMS version, in order to minimise possible risks.
Further information on the vulnerabilities and the published security updates is provided by the PHP project in its official security notices.