Critical PHP Security Vulnerability
- Status
- Resolved
- Start
- 21.10.2026 14:32
- End
- 21.10.2026 15:52
This morning, a critical PHP vulnerability was discovered that allows remote code execution. Specifically, this involves the vulnerabilities CVE-2026-109618 and CVE-2026-109619. We have already deployed an update to our web servers that should fix the issue, though this has not yet been confirmed. For this reason, some functions are restricted, and we have activated maintenance mode.
An official PHP update is scheduled for 4:00 p.m. German time, our servers are already prepared for it.
Timeline
-
Resolved 21.10.2026 15:52
The issue has been resolved. All systems are reachable again.
-
Update 21.10.2026 15:45
The PHP security update has already been rolled out; we are now rolling out the update to our web cluster.
-
Reported 21.10.2026 14:32
We are aware of this issue and will post updates here as soon as we know more.
Still affected or have questions?
Our support team responds within minutes, in German or English.