Do you have Questions ?
Fabian Müller
Managing Director, Schaffhausen Region
Two critical security vulnerabilities have come to light in PHP, a scripting language used worldwide. PHP forms the technical basis for a large proportion of all websites and web applications globally; consequently, the vulnerability affects numerous providers and organisations. It does not lie within our own software, but in PHP itself.
The PHP team has announced a security update, which is expected to be released today at 4.00 pm. From that point onwards, it will be possible to patch the affected systems. Until then, we are following the recommendation of the EU cybersecurity service CERT-EU: as a service provider, we are taking the precautionary step of taking individual services that use PHP and are publicly accessible offline for our customers. This is purely a precautionary measure to rule out any potential risks to you and your data from the outset.
As soon as the update is available, we will patch the systems as quickly as possible and gradually bring the services back online. For most systems, we expect this to be possible swiftly. However, some systems have dependencies on third-party vendors, whose software must first be made compatible with the update. In these cases, the restoration process may take longer.
All other services are unaffected and continue to run as normal. We will keep you updated on the latest developments on this page. You will find out here as soon as the affected services are available again.
Current status
Last updated: 21 October 2026, [1.00 pm]
Status ticker
The latest update is always at the top.
21 October 2026, [10.50 pm]: The critical PHP security update has been applied; the services have been updated and are once again fully available. We have been able to secure our web services, dedicated Nextcloud appliances and other publicly accessible systems with the latest version of PHP. The exception is a small number of customer systems running older versions of PHP for which PHP no longer provides official security updates. Until further notice, these are protected by additional security measures, which may temporarily restrict certain functions. We are in direct contact with the affected customers and are working together to find a permanent solution.
21 October 2026, [3.40 pm]: The PHP security update has been released. We have begun deploying it on the affected systems and will gradually bring the services back online once testing has been successfully completed. For some systems, we are still awaiting updates or authorisation from the relevant software vendors. As a precaution, these services will remain offline until the vendors make their updates available.
21 October 2026, [1.00 pm]: As a precautionary measure, we have taken individual PHP services offline for our customers. The security update is expected to be released today at 4.00 pm.
The two security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow attackers to execute malicious code on servers without logging in. All versions of PHP from PHP 5 onwards are potentially affected.
CERT-EU is the cybersecurity team for the institutions of the European Union. It has published an official security advisory regarding the two vulnerabilities and recommends patching affected systems as soon as possible and taking publicly accessible applications offline until then. The German Federal Office for Information Security (BSI) has also issued a corresponding security advisory.
Further information:
Many of the websites and applications we operate for our customers are based on PHP. Until the security update has been applied, we are taking publicly accessible PHP services offline as a precautionary measure. Safety comes first.
We are checking all customer systems and will only take down those services where it is necessary for security reasons. If you are unsure whether your service is affected, please feel free to give us a call.
The security update will be available from 4.00 pm. We will install it on all affected systems as quickly as possible, then check them thoroughly and gradually bring the services back online. For systems with dependencies on third-party manufacturers, we must first ensure that their software is compatible with the update. To this end, we are in close contact with the respective manufacturers. We have deliberately chosen not to specify an exact time until we can confirm it with certainty. As soon as your services are up and running again, you will find out here.