PHP Security Update: Status Report and Actions
Our systems were affected by the PHP vulnerability but were fully secured by 21 October 2026 at 20:00 CEST. There is no evidence of misuse or data leakage, and no outages occurred.
Summary
Our systems were affected by the vulnerability. It was closed on the same day – approximately two and a half hours after the manufacturer provided the patched PHP runtime. There are no indications of misuse or access to customer data. There were no outages.
Impact & Status
Yes, we were affected – the vulnerability has since been closed. The vulnerability was in the software foundation (PHP) on which our websites, the Conteo Publisher, our interfaces, and background processes run. Until the manufacturer provided a patched PHP runtime, this foundation was vulnerable. Areas that do not run on this foundation – such as the delivery of images and files or our analytics services – were not affected. Since 21 October 2026, 20:00 CEST, all affected systems have been running with the corrected version. No further action is required.
Actions Taken
- We implemented the patched PHP runtime immediately after its release and rolled it out across all affected systems: on 21 October 2026 at 20:00 CEST, approximately two and a half hours after it was made available by the manufacturer.
- In addition, we have tightened two security precautions that further complicate attacks via the known method.
- We ensure that necessary patches will continue to be implemented quickly and efficiently in the future.
- Outstanding actions for this vulnerability: none.
Integrity of Customer Data
There are no indications of unauthorised access. We have evaluated our systems' logs for the affected period – these record access, errors, and restarts. Result: no signs of exploitation, no indications of external access, data leakage, or changes to data. An attack via this vulnerability would have left visible traces in these logs.
Downtime
No, there was no downtime. The update was implemented during live operations; users were able to continue working without interruption. The agreed availability levels were maintained and were at no time undercut. No further maintenance windows are required or planned for this process.
Further information:
- Security Advisory on PHP.net | CERT-EU Security Advisory 2026-018
- Background / Discussion: Advance Notice | Release
