Gentlent incident
Emergency PHP security update (CVE-2026-109618 / CVE-2026-109619)
Resolved on October 21, 2026.
On October 21, 2026, the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP’s core. Left unpatched, these flaws could allow an unauthenticated attacker to execute code remotely on affected servers. Germany’s Federal Office for Information Security (BSI) also issued a warning and urged operators to patch immediately. We updated PHP across our web hosting platform to the fixed releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and both vulnerabilities are now closed for our web hosting customers. This was an emergency security update, not a service disruption, and no action is required from customers hosted on our platform. If you run PHP applications outside our infrastructure, we recommend updating to a fixed release as soon as possible. --- References --- PHP release announcement: https://www.php.net/archive/2026.php#2026-10-21-5 BSI security advisory (BITS-H 2026-297981-1032, German): https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.pdf?__blob=publicationFile&v=3
Update timeline
- resolved Oct 21, 2026, 03:57 PM UTC
On October 21, 2026, the PHP project released security updates for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP’s core. Left unpatched, these flaws could allow an unauthenticated attacker to execute code remotely on affected servers. Germany’s Federal Office for Information Security (BSI) also issued a warning and urged operators to patch immediately. We updated PHP across our web hosting platform to the fixed releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35), and both vulnerabilities are now closed for our web hosting customers. This was an emergency security update, not a service disruption, and no action is required from customers hosted on our platform. If you run PHP applications outside our infrastructure, we recommend updating to a fixed release as soon as possible. --- References --- PHP release announcement: https://www.php.net/archive/2026.php#2026-10-21-5 BSI security advisory (BITS-H 2026-297981-1032, German): https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.pdf?__blob=publicationFile&v=3
Your product runs on more than Gentlent
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services