# Hetzner: PHP security issues CVE-2026-109618 and CVE-2026-109619

> Hetzner status incident “PHP security issues CVE-2026-109618 and CVE-2026-109619” on 2026-10-21: impact minor (vendor’s label), 5 update(s). Archived by Rewindex.

Canonical: https://rewindex.com/company/hetzner/incidents/f4144d55-38c3-48d1-8664-7a3429355cd7
Last updated: 2026-10-26T03:10:46Z

- Impact (vendor’s label): minor
- Status: investigating
- Started: 2026-10-21 11:04 UTC · Resolved: not resolved · Duration: ongoing
- Updates: 5
- [Vendor status page: https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7](https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7)
- [Company: Hetzner](https://rewindex.com/company/hetzner.md)

## CVEs mentioned

- [CVE-2026-109618](https://rewindex.com/cve/CVE-2026-109618.md) RCE via OOM corruption (CVSS 9.8 critical): names this CVE
- [CVE-2026-109619](https://rewindex.com/cve/CVE-2026-109619.md) RCE via stale global state (CVSS 8.1 high): names this CVE

_Only CVEs the incident text names by id, or that the notice says the vendor is not affected by. Not a statement of cause._

## Discussed on Hacker News

- [Hetzner Outage](https://news.ycombinator.com/item?id=50178645): 4 points, 2 comments, posted 2026-10-21 10:35 UTC, posted 29 min before the vendor’s first update

## Timeline of updates

- **investigating** 2026-10-21 11:04 UTC: Start: 2026-10-21T11:04:08+00:00 The PHP versions we use are affected by the recently disclosed vulnerabilities CVE-2026-109618 and CVE-2026-109619. We will, of course, apply patches as soon as they become available. We are checking whether we can deploy mitigations in the meantime.
- **investigating** 2026-10-21 13:47 UTC: We are closely monitoring the situation and are already evaluating possible measures to mitigate the impact of these vulnerabilities until the corresponding security updates become available. According to the PHP Group, further information is expected to be released today at approximately 16:00 CEST (14:00 UTC). As soon as this information becomes available, we will review it immediately and take the necessary steps to address the vulnerabilities as quickly as possible. We will continue to provide updates on further developments and the progress of our mitigation and remediation efforts on this status page. For more information, please visit the official PHP Group website: https://www.php.net/archive/2026.php\#2026-10-20-1
- **investigating** 2026-10-21 14:34 UTC: The security update announced by the PHP developers for the two critical security vulnerabilities is now available: https://www.php.net/archive/2026.php\#2026-10-20-1 Immediately after its release, we began rolling out the security update to our systems (konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin, Webmail). The full update may take some time. We will continue to keep you informed of the current status here. We have implemented the mitigations recommended by PHP prior to the release of the security update (https://www.php.net/archive/2026.php\#2026-10-21-5). We will notify customers of dedicated servers and cloud servers separately via email regarding the situation. As a general rule, we recommend that you carefully monitor your systems for suspicious activity and possible signs of an attack.
- **investigating** 2026-10-21 17:50 UTC: We deployed patches for the PHP versions 7.4 and 8.0-8.5 on all Webhosting- and Managed-Servers. We continue to work on patches for the older PHP versions and will continue to keep you informed of the current status here.
- **investigating** 2026-10-22 04:32 UTC: We deployed patches for the remaining PHP versions 5.6 and 7.3 on all Webhosting- and Managed-Servers.


---
Canonical: https://rewindex.com/company/hetzner/incidents/f4144d55-38c3-48d1-8664-7a3429355cd7 · Markdown: https://rewindex.com/company/hetzner/incidents/f4144d55-38c3-48d1-8664-7a3429355cd7.md · JSON: https://rewindex.com/api/v1/companies/hetzner/incidents/f4144d55-38c3-48d1-8664-7a3429355cd7 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:46.684Z