php2shell: Our servers are secured
What happened?
On 20 October 2026 the PHP project disclosed two serious security vulnerabilities in the PHP programming language (CVE-2026-109618 and CVE-2026-109619, known as "php2shell"). PHP powers a large share of all websites worldwide, our applications included.
What could an attacker have done?
With specially crafted requests, an attacker could under certain circumstances have run their own program code on an affected server without having to log in first.
What did we do?
On 21 October, one day after the disclosure, we updated all our servers to the fixed PHP versions.
Was there an attack?
We searched all servers for signs of an attack and found none.
Do I need to do anything?
No. Your data and accounts remain unchanged, you do not need to change any passwords or take any other action.