APPUiO Cloud Status

Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619): action required

Major incident Zone LPG 2 OpenShift Console OpenShift / Kubernetes API Image Registry Networking Ingress Zone CH-GVA-2 0 OpenShift Console OpenShift / Kubernetes API Image Registry Networking Ingress Storage Storage
2026-10-21 16:55 CEST · 7 hours, 8 minutes

Updates

Issue

The PHP project has published a security release fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2). They can be exploited remotely and without authentication and can lead to remote code execution. All PHP installations serving web requests are affected.

Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project. Configuration workarounds only reduce exposure, updating is the only complete fix.

What we are doing

We have been monitoring the situation since yesterday evening, when the PHP project announced the upcoming release. We are redeploying the container images we maintain as soon as patched images are available.

What you need to do

Images built and deployed by you are not updated by us. Please rebuild your container images on a patched PHP version and redeploy your applications now. If you run PHP 8.1 or older, upgrade to a supported version.

If you have any questions, please contact us at support@vshn.ch.

October 21, 2026 · 16:55 CEST

← Back