VSHN Services Status

Critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619): action required

Major incident Managed Server and Services Puppet Infrastructure Icinga Monitoring Services BURP Backup Infrastructure Package Cache APPUiO Managed Infrastructure Project Syn Lieutenant APPUiO Managed OpenShift Control Plane CNI Plugins ("network plugins") Cilium (Isovalent Enterprise for Cilium) openshift-sdn OVNKubernetes Storage Cluster (rook-ceph) Cluster Monitoring Cluster Logging Infrastructure VSHN Paralus cloudscale Puppet Managed Loadbalancers
2026-10-21 16:47 CEST · 7 hours, 52 minutes

Updates

Retroactive

What happened

The PHP project has published a security release fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 9.2 (v4.0). They can be exploited remotely and without authentication, and can lead to remote code execution on the affected server. All PHP installations that serve web requests are affected (PHP-FPM, Apache with mod_php, php-cgi and others).

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project. Configuration workarounds exist, but they only reduce exposure. Updating is the only complete fix.

What we are doing

We have been monitoring the situation since yesterday evening, when the PHP project announced the upcoming release. This is where we stand:

  • Virtual machines running PHP: We have already updated PHP on all VMs for which the distribution (Ubuntu, Red Hat) has released patched packages. The remaining VMs will follow as soon as the packages are available. Where a restart is required, it may briefly affect availability.
  • Docker images maintained by VSHN: We are redeploying our images as soon as patched base images are available.
  • Workloads managed by you: Images built and deployed by you are not updated by us. You need to rebuild them on a patched PHP version and redeploy.

What you need to do

Please update the PHP version in your applications and container images now and redeploy. If you run PHP 8.1 or older, upgrade to a supported version or check with your vendor for a backported fix.

If you have any questions, please contact us at support@vshn.ch.

VSHN

October 21, 2026 · 16:47 CEST

← Back