PHP Security Vulnerability: What Happened and What You Need to Know Now
Yesterday, many websites and server services experienced noticeable restrictions and outages.
For this reason, we would like to transparently inform you about what happened yesterday, what the
current status is, and how we are taking care of your systems.
1. What happened?
Yesterday, two critical security vulnerabilities in the scripting language PHP were disclosed – the
so-called PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). PHP is
the technical foundation for most content management systems and websites.
Through these vulnerabilities, attackers could, under certain circumstances, remotely execute foreign code on
servers. Because intelligent AI bots nowadays scan the internet around the clock for precisely such vulnerabilities
to automatically attack countless systems in the shortest possible time, quick action was required.
To protect the server infrastructure and, above all, your customer data, protective measures were
proactively activated in the data center yesterday. Various
systems, administration interfaces, and services were temporarily shut down or
restricted for several hours.
2. What is affected? (Most of the problem has already been resolved)
The most important news first: The situation has largely stabilized and the security measures
are underway.
- Websites are accessible: Your websites themselves are online as usual and accessible to your
visitors. - Patches largely applied: Thanks to the quick intervention in the data centers,
security patches for almost all affected PHP versions were successfully applied
yesterday evening and overnight. - No indications of exploits: Previous internal checks have yielded no indications
that the security vulnerability was exploited on the existing IT infrastructure. - Website administration temporarily restricted: Access to technical
administration in the background (such as customer centers or administration) is currently
still impaired in some places. We are continuously checking these accesses for you.
Note on older PHP versions: For very old versions (below PHP 5.6), no official security updates
are available from the PHP project. Here, the data center is intensively working on
individual protective measures and solutions.
3. We are taking care and are in contact with the hosts
You do not need to take any action yourself at this point. In most cases, the
problem must and will be resolved directly at the server level by the host – and this is being worked on with high priority.
We continuously monitor developments for you, are in direct contact with the
technicians, and regularly check the status of the systems. Should further action be required for your specific website
(e.g., due to an older PHP version), we will contact you personally.
4. If you wish to take action yourself (or have questions)
If you wish to inquire about the security status of a website yourself with an external hosting provider,
you can use the following pre-formulated message:
Template text for inquiries to the host:
„Please confirm the PHP security status of our website. Have both PHP2Shell vulnerabilities,
CVE-2026-109618 and CVE-2026-109619, been resolved in the currently running PHP environment?
Which package or build version confirms this, and since when has the correction been active? If the
fix is still pending: Who is responsible for it and what is the next step?“
We are here for you
Your security and the smooth functioning of your digital presence are our top priority.
We sincerely thank you for your understanding regarding the necessary
protective measures taken yesterday.
Should you have any concerns, uncertainties, or specific questions about your website, please feel free
to contact us directly at any time – we will assist you immediately.
Your KAOS Team
