On October 21, 2026, the PHP project released updates for two critical security vulnerabilities. Practically all websites running on PHP are affected—regardless of the Content Management System (CMS) being used. Below is an overview of what this situation means for your website.
Under certain circumstances, an attacker can exploit two newly discovered vulnerabilities to execute arbitrary code on the server without prior authentication. The UK’s National Cyber Security Centre (NCSC) and other authorities have issued warnings accordingly. Fortunately, patched PHP versions are already available.
Important Note: This warning does not automatically mean that any specific website has already been attacked or compromised. It is a precautionary warning.
The Two Vulnerabilities in Detail
The Two Vulnerabilities in Detail
- CVE-2026-109618 (Memory Shortage Error): PHP can be interrupted in the middle of processing a request and subsequently continue working with incomplete data by mistake.
- CVE-2026-109619 (Data Residuals in Memory): Internal data from a request remains in the system after memory is released and can potentially be reused by a subsequent request.
Which PHP Versions Are Secure?
Which PHP Versions Are Secure?
The risk can be defined by the exact version number. The following versions (and newer) are secured against these vulnerabilities:
- PHP 8.2: Secure from version 8.2.35
- PHP 8.3: Secure from version 8.3.36
- PHP 8.4: Secure from version 8.4.27
- PHP 8.5: Secure from version 8.5.12
Attention regarding outdated versions: The PHP project generally no longer releases updates for PHP 8.1 and older versions—this also applies to these current security vulnerabilities.
Does This Affect TYPO3?
No. The vulnerability lies directly within the core of the PHP programming language, not in TYPO3, WordPress, or any other CMS. Because the attack often occurs before the website's code is even executed, a pure TYPO3 update does not close this vulnerability. Furthermore, all common operating modes (such as PHP-FPM, Apache mod_php, or CGI) are affected.
Conversely, the necessary PHP update generally does not require any adjustments to your TYPO3 website—your web presence will continue to function unchanged after the update.
Status for Websites Hosted by Us
All websites hosted directly with us or our hosting partner Mittwald were proactively shut down briefly on October 21 and patched with the necessary security updates on the same evening—including older PHP versions.
- As a result, the affected websites were temporarily unavailable between approximately 4:00 PM and late evening (email services were not affected).
- Initial checks by the hoster showed no evidence that the vulnerability was exploited on our clients' systems.
- There is no action required on your part.
If your website runs on an external server (e.g., with other hosters like Hetzner, Metanet, etc.), the procedure depends on the respective hosting model:
- Shared or Managed Hosting: Your hosting provider must install the update. The exact version number is crucial (e.g., 8.3.36)—a general indication like "PHP 8.3" in the customer panel is not sufficient.
- Backporting: Some hosters integrate the fix into older version numbers. In this case, written confirmation from the provider is required stating that both specific vulnerabilities have been closed.
- Dedicated Servers: Administrators must update PHP immediately and restart all PHP processes.
- PHP 8.1 or Older: An upgrade to a current PHP version is urgently recommended here (often combined with a TYPO3 update).
Note: Administrators can find the exact PHP version of their system in the TYPO3 backend at the top right via the info icon ("i" under system information). Temporary configuration adjustments usually only mitigate the risk; they do not replace a full update.
Our Support for You
For websites that we manage but which run on external servers, we are currently reviewing the PHP versions. Since we do not have direct access to the server environment with external hosting, we kindly ask you to check with your hosting provider whether the necessary security updates have been applied successfully. If you have any questions or need assistance with this, please feel free to contact us directly.