Dear de.NBI Cloud Tübingen users,
today we were informed about two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619,
CVSS 9.2) possibly allowing remote code execution without login.
Fixed versions come out today, 21 October, 16:00 CEST (Berlin/Paris).
- https://cert.europa.eu/publications/security-advisories/2026-018/
- https://www.php.net/archive/2026.php#2026-10-20-1
Please IMMEDIATELY isolate or shutdown all applications using PHP and connected to public networks and patch when the fixes become available.
We reserve the right to isolate / shutdown user VMs that we detect and are still using vulnerable PHP versions.
Kind Regards, Benjamin
On behalf of the de.NBI Cloud Tübingen team