PHP security vulnerabilities: Assessment and update preparations

✅ All services restored

We have completed the required PHP security updates on all affected EDIS Global platform systems. Our Control Panel, Order API and Management API are back online, and all services are operating normally.

Thank you for your patience during this precautionary shutdown.

View the status notice

🚨 Emergency security measure

As a precaution against the critical PHP vulnerabilities, we are temporarily shutting down the following services:

• Order API
• Management API
• Control Panel

We are awaiting the announced PHP security patches. Access will be restored once the necessary updates have been applied and verified.

We will keep you informed through this status notice.

The vulnerabilities have been reported as potentially allowing unauthenticated remote code execution—meaning an attacker could execute code on an affected server without first logging in. Further information is available in the CERT-EU security advisory.

The PHP security team has scheduled a security release for 21 October 2026 at 14:00 UTC, with affected versions and technical details to be published alongside the updates.

Customers running PHP on their own VPS or dedicated server should prepare to update their installations. For self-managed services, software updates within the server remain the responsibility of the customer or their system administrator.

We recommend the following steps:

• Identify your PHP installations, including versions used by individual websites, hosting control panels and containers.
• Install security updates as soon as they become available from your operating system, package repository or control-panel vendor. Check the vendor’s advisory to confirm that the installed package addresses these CVEs.
• Restart the affected services or redeploy updated containers as required, and verify that your websites are using the patched PHP runtime.
• If a fix is unavailable or cannot be applied promptly, consider temporarily restricting public access to affected PHP applications until they can be secured.

Updating a CMS or its plugins alone does not replace updating the underlying PHP runtime.

Official resources for administrators:

• PHP installation and platform-specific guidance
• PHP supported versions and security-support lifecycle
• Ubuntu Security Notices
• Debian security advisories and update information

The security and stability of our services remain our highest priority. Further updates will be published here.

We are aware of the recently reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 and are closely monitoring developments and security advisories.

We are currently assessing the potential impact on the systems we operate and preparing the necessary steps to update affected systems.

The security and stability of our services remain our highest priority. We will update this status notice with confirmed information about planned measures, their progress, and any potential impact on service availability.

Thank you for your understanding.