rewindex

CompaniesHetznerIncidents

Hetzner: PHP security issues CVE-2026-109618 and CVE-2026-109619

MinorStatus: investigatingStarted Not resolved5 updatesstatus.hetzner.com (opens in new tab)

CVEs mentioned

Only CVEs the vendor’s text names by id, or that its notice says it is not affected by. A mention is not a statement that the vulnerability caused this incident.

Discussed on Hacker News

Threads are matched automatically by vendor name and timing; points and comments refresh every 30 minutes. Method and limits.

Timeline of updates

  1. investigating

    Start: 2026-10-21T11:04:08+00:00
    The PHP versions we use are affected by the recently disclosed vulnerabilities CVE-2026-109618 and CVE-2026-109619. We will, of course, apply patches as soon as they become available. We are checking whether we can deploy mitigations in the meantime.

  2. investigating

    We are closely monitoring the situation and are already evaluating possible measures to mitigate the impact of these vulnerabilities until the corresponding security updates become available.
    According to the PHP Group, further information is expected to be released today at approximately 16:00 CEST (14:00 UTC). As soon as this information becomes available, we will review it immediately and take the necessary steps to address the vulnerabilities as quickly as possible.
    We will continue to provide updates on further developments and the progress of our mitigation and remediation efforts on this status page.
    For more information, please visit the official PHP Group website:
    https://www.php.net/archive/2026.php#2026-10-20-1 (opens in new tab)

  3. investigating

    The security update announced by the PHP developers for the two critical security vulnerabilities is now available: https://www.php.net/archive/2026.php#2026-10-20-1 (opens in new tab)
    Immediately after its release, we began rolling out the security update to our systems (konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin, Webmail). The full update may take some time. We will continue to keep you informed of the current status here.
    We have implemented the mitigations recommended by PHP prior to the release of the security update (https://www.php.net/archive/2026.php#2026-10-21-5 (opens in new tab)).
    We will notify customers of dedicated servers and cloud servers separately via email regarding the situation.
    As a general rule, we recommend that you carefully monitor your systems for suspicious activity and possible signs of an attack.

  4. investigating

    We deployed patches for the PHP versions 7.4 and 8.0-8.5 on all Webhosting- and Managed-Servers.
    We continue to work on patches for the older PHP versions and will continue to keep you informed of the current status here.

  5. investigating

    We deployed patches for the remaining PHP versions 5.6 and 7.3 on all Webhosting- and Managed-Servers.

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves this record existed by then and has not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Impact, status and times are the vendor’s own, as last archived. View on status.hetzner.com (opens in new tab).

Hetzner profileRecent Hetzner incidentsMarkdownJSON