Vorabinformation: Critical Security Lucks in PHP (CVE-2026-109618, CVE-2026-109619)
We would like to inform you about two critical security issues in PHP, which were reported in the PHP Security Community under CVE-2026-109618 and CVE-2026-109619. After the current knowledge you can access both the operating codes of the affected systems (Remote Code Execution) and the information about the PHP Security Team with a “critical” (CVSS v4.0: 9.2) evaluation.
Aktueller Stand
The official security update will be released on October 21, 2026 at 2:00 PM UTC (4:00 PM MESZ). The PHP project itself is subject to further updates, including details regarding the changes that are required to ensure active implementation. Best details will be available before the relevant versions and their instructions are available. Official patches have been carefully examined for the latest PHP versions (8.2 and new) versions. For the first version, there is no official fix to erwarten.
You can find the official Vorankündigung des PHP-Projekts here: https://www.php.net/archive/2026.php#2026-10-20-1
Wer ist affected?
Power all systems, including PHP, complete support, well-known products and services (Web hosting, Managed Server, Managed Cloud Cluster, Root Server, VPS). The operation is easier than the operation of the PHP installation, but not within the installation.
We are here to help you (Web Hosting, Managed Server)
with the basic information you need to prepare your configuration and heartfelt questions for the results of the release of the patches for the official details. Since the official patch will be released, we will automatically roll into all affected systems. For newer PHP versions, for a new official patch, we will implement and use one patch. Ein Eingreifen Ihrerseits ist nicht goedorderlich.
Was Sie tu tunten (Root Server, VPS, Managed Cloud Cluster)
Bei Root Servern, VPS und den VMs auf Managed Cloud Clustern liegt die Behebung in Ihrer Verantwortung. We want urgently:
- Use your own PHP versions on your own systems since.
- Planen Sie, das official Update unmittelbar nach Veröffentlichung einzuspielen. With the feedback you will receive, you will be able to receive the patches.
- If you want to install a new PHP version, you will receive an official patch: When a patch for new PHP versions is available, we will not be able to update the distribution backports until now. Read about the implementation of the necessary implementation of the PHP version and prepare the upgrade for it.
Recent updates
We will inform you about the time after the official release of the officials Updates with a final assessment on the basis of the official details. About these important Entwicklungen informieren wir morehin about netcup-status.de and by Rundmail.
Advance notice: Critical security vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
We would like to give you advance notice of two critical security vulnerabilities in PHP, tracked by the PHP security community as CVE-2026-109618 and CVE-2026-109619. Based on current information, both allow the execution of malicious code on affected systems (remote code execution) and have been rated by the PHP Security Team with a severity of “critical” (CVSS v4.0: 9.2).
Current status
The official security update will be released today, 21 October 2026, at 14:00 UTC (16:00 CEST). The PHP project reserves the right to release the update earlier should details of the vulnerabilities become public or should active exploitation be observed. Confirmed details on affected versions and the root cause will only be available with the release. Official patches are expected only for currently supported PHP versions (8.2 and newer). No official fix is expected for older versions.
The official advance notice from the PHP project is available here: https://www.php.net/archive/2026.php#2026-10-20-1
Who is affected?
Potentially all systems running PHP, regardless of which product you use with us (Webhosting, Managed Server, Managed Cloud Cluster, Root Server, VPS). Patching is only possible at the level of the PHP installation itself, not within the application.
What we are doing (Webhosting, Managed Server)
Based on the information currently available, we are preparing configuration and hardening measures and will verify them against the official details once the patch has been released. As soon as the official patch is available, we will roll it out automatically on all affected systems. For older PHP versions for which no official patch will be released, we will develop and apply a patch ourselves. No action is required on your part.
What you should do (Root Server, VPS, Managed Cloud Cluster)
For Root Servers, VPS and the VMs on Managed Cloud Clusters, patching is your responsibility. We strongly recommend the following:
- Check now which PHP versions are in use on your systems.
- Plan to apply the official update immediately after its release. Attack attempts are to be expected shortly after the patch becomes public.
- If you are using a PHP version for which no official patch will be released: it is currently not foreseeable when a patch for older PHP versions will become available through unofficial channels (such as distribution backports). Therefore, verify your application's compatibility with a supported PHP version and prepare the upgrade.
Next update
We will follow up today shortly after the release of the official update with an assessment based on the official details. We will continue to inform you about the most important developments via netcup-status.de and by email.