PHP security vulnerabilities: Assessment and update preparations

Update timeline

1. investigating Oct 21, 2026, 12:11 PM UTC

   The vulnerabilities have been reported as potentially allowing **unauthenticated remote code execution**—meaning an attacker could execute code on an affected server without first logging in. Further information is available in the [CERT-EU security advisory](https://cert.europa.eu/publications/security-advisories/2026-018). The [PHP security team](https://www.php.net/archive/2026.php#2026-10-20-1) has scheduled a security release for **21 October 2026 at 14:00 UTC**, with affected versions and technical details to be published alongside the updates. **Customers running PHP on their own VPS or dedicated server should prepare to update their installations.** For self-managed services, software updates within the server remain the responsibility of the customer or their system administrator. We recommend the following steps: - **Identify your PHP installations**, including versions used by individual websites, hosting control panels and containers. - **Install security updates as soon as they become available** from your operating system, package repository or control-panel vendor. Check the vendor’s advisory to confirm that the installed package addresses these CVEs. - **Restart the affected services or redeploy updated containers as required**, and verify that your websites are using the patched PHP runtime. - **If a fix is unavailable or cannot be applied promptly, consider temporarily restricting public access** to affected PHP applications until they can be secured. Updating a CMS or its plugins alone does not replace updating the underlying PHP runtime. Official resources for administrators: - [PHP installation and platform-specific guidance](https://www.php.net/manual/en/install.php) - [PHP supported versions and security-support lifecycle](https://www.php.net/supported-versions.php) - [Ubuntu Security Notices](https://ubuntu.com/security/notices) - [Debian security advisories and update information](https://www.debian.org/security/) The security and stability of our services remain our highest priority. Further updates will be published here.

2. investigating Oct 21, 2026, 12:33 PM UTC

   **🚨 Emergency security measure** As a precaution against the critical PHP vulnerabilities, we are temporarily shutting down the following services: - **Order API** - **Management API** - **Control Panel** We are awaiting the announced PHP security patches. Access will be restored once the necessary updates have been applied and verified. We will keep you informed through this status notice.