Approximately 80 % of the affected systems have been patched and are back online. All systems with official PHP security updates (PHP 8.2 and newer) as well as all Anexia platforms, including the Anexia Engine, are patched and fully available.

The remaining customer systems, mainly older PHP versions and special setups, require individual handling and are still being worked on. We expect to complete the vast majority within the next few hours. Where a fix cannot readily be applied, we will contact the customers concerned directly.

Unmanaged Services: if not done yet, update immediately. Attacks on unpatched systems must be expected.

Next update by 21:30 UTC / 23:30 CEST.

The PHP security updates (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) were released at 14:00 UTC. We are deploying them to all affected Managed Services and bringing services back online after verification.

Approximately two thirds of the affected systems have been patched and are back online. The Anexia Engine (web interface and API) is fully available again.

For some older PHP and OS versions, we are applying backported fixes from established LTS sources; these systems need more time due to separate verification. Where no fix is available, we will contact the customers concerned individually.

Unmanaged Services: please update to a fixed version immediately. Until then, keep PHP services offline or restrict access.

Next update by 19:00 UTC / 21:00 CEST.

This morning we informed you about two critical security vulnerabilities (CVE-2026-109618, CVE-2026-109619) in PHP. The situation has since changed, and we need to adapt our approach.

Our decision To protect your systems and data, we will take all Managed Services that use PHP offline as a precaution from 13:45 UTC / 15:45 CEST. These services will remain offline until the official patch is available and has been verified and deployed by us.

What has changed Based on our findings, the workarounds and hardening measures known so far do not provide effective protection. We must assume that a working exploit will be available and actively used immediately after the patch is published at 14:00 UTC / 16:00 CEST.

The vulnerability allows attackers to execute arbitrary code on affected systems. No security update is available yet. Until it is, any system running PHP is potentially vulnerable as soon as it is reachable from the internet. This is why we have decided to take this step. We are aware that it is a drastic measure. However, we are convinced that a brief interruption is preferable to a successful attack on your website or your data. Numerous companies and public authorities worldwide are currently taking the same approach.

What this means for you Your affected Managed Services will not be reachable during this period. The Anexia Engine will also be unavailable, including both the web interface and the API. Incoming requests will not be buffered or processed retroactively; they will be dropped during this period. You will continue to have direct access to your systems. Existing data and configurations remain unchanged. This is a shutdown of access, not an intervention in your systems.

Restoration of services We are currently unable to provide a definitive time for restoring services, as this depends on when the patch is published and on the subsequent verification. Services running PHP versions for which an official patch is released will be brought back online step by step once the patch has been deployed. For services running PHP versions without an official patch, we will contact you individually to agree on the next steps.

Note for Unmanaged Services For Unmanaged Services, the decision is yours. We strongly recommend that you also take your PHP-based services offline until the patch has been deployed, or restrict access to the minimum necessary.

Technical details The vulnerabilities concerned are CVE-2026-109618 and CVE-2026-109619 (severity: critical, CVSS 9.2). Potentially affected are all websites and applications that use PHP. The official pre-announcement by the PHP project is available here: https://www.php.net/archive/2026.php#2026-10-20-1

Availability and updates We will provide updates every 2 hours via our status page at https://anexia-status.com, and will inform you immediately once your services have been restored.

We are aware that this step has a significant impact on your operations. Given the current threat situation, we consider it necessary to protect your systems from compromise, and we ask for your understanding.

Based on our analysis, initial mitigation measures are already being implemented on our systems wherever possible to minimize potential risks.

Exploit code for these vulnerabilities is already known. Its effectiveness has not yet been verified, but we are treating the threat as real and taking appropriate security measures accordingly.

As soon as the patch becomes available today at 14:00 UTC (16:00 CEST), as announced, we will apply the necessary updates to all affected managed systems where technically possible (PHP 8.x).

We will provide further updates as soon as relevant new information becomes available.