{"id":25123,"date":"2026-10-22T07:34:17","date_gmt":"2026-10-22T07:34:17","guid":{"rendered":"https:\/\/www.securitytoday.de\/?p=25123"},"modified":"2026-10-22T12:40:02","modified_gmt":"2026-10-22T12:40:02","slug":"php-flaws-security-agencies-advise-shutdowns","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/10\/22\/php-flaws-security-agencies-advise-shutdowns\/","title":{"rendered":"PHP flaws: Security agencies advise taking sites offline"},"content":{"rendered":"<p><strong>On Wednesday, authorities, hospitals, universities and governments in several European countries took their websites offline as a precaution. Two critical PHP flaws could allow code execution without authentication. Several security agencies advised shutting systems down where immediate updates were impossible. Meanwhile, developer platforms reported attacks on their customers\u2019&nbsp;credentials.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Several security agencies advised shutting systems down.<\/strong> CISA and CERT-EU recommended taking PHP systems offline if they could not be updated&nbsp;immediately.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">The flaws had been in the code for over a decade.<\/strong> According to Wiz Research, frontier AI models helped find them and make them&nbsp;exploitable.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">Developer platforms reported breaches.<\/strong> Data from 321,810 Zeabur accounts was stolen, while Railway advised all users to rotate keys stored on its&nbsp;platform.<\/li>\n<\/ul>\n<\/div>\n<p style=\"border-bottom:1px solid rgba(230,227,218,0.14);padding:14px 0;margin:28px 0;font-size:0.92em;color:#b8c5ce;\"><strong style=\"color:#69d8ed;\">Related:<\/strong> <a href=\"https:\/\/www.securitytoday.de\/2026\/10\/15\/openssl-cra-post-quantum-verantwortung\/\">OpenSSL: What vendors must now demonstrate<\/a> &nbsp;\u00b7&nbsp; <a href=\"https:\/\/www.securitytoday.de\/2026\/10\/14\/simon-gooch-ki-agenten-zugriffsrechte-stopp\/\">Simon Gooch: AI agents need a tested&nbsp;stop mechanism<\/a><\/p>\n<h2>Websites shut down as a&nbsp;precaution<\/h2>\n<p>A patch for two critical PHP flaws was scheduled for 16:00 German time on Wednesday. BSI (Germany\u2019s Federal Office for Information Security) called for it to be <a href=\"https:\/\/www.bsi.bund.de\/SharedDocs\/Cybersicherheitswarnungen\/DE\/2026\/2026-297981-1032.html\">installed immediately upon release<\/a>. CERT.at advised identifying PHP systems and <a href=\"https:\/\/www.cert.at\/de\/aktuelles\/2026\/10\/bevorstehendes-kritisches-php-sicherheitsupdate\">scheduling an update window for 16:00<\/a>.<\/p>\n<div style=\"display:flex;flex-wrap:wrap;gap:16px;margin:32px 0;\">\n<div style=\"flex:1 1 200px;min-width:0;background:#003340;border:1px solid rgba(105,216,237,0.28);border-radius:10px;padding:22px 20px;box-sizing:border-box;\">\n<div style=\"font-size:1.4em;font-weight:800;color:#69d8ed;line-height:1.1;word-break:keep-all;\">69.3 percent<\/div>\n<p style=\"margin:10px 0 0;font-size:0.88em;color:#e6e3da;line-height:1.5;\">According to W3Techs, PHP powers 69.3 percent of all websites whose server-side programming language is known. <a href=\"https:\/\/w3techs.com\/technologies\/details\/pl-php\" style=\"font-size:0.78em;color:#8fa3ab;\">Source<\/a><\/p>\n<\/div>\n<\/div>\n<p>In Berlin, the websites of the Robert Koch Institute, the Federal Intelligence Service (BND), the Federal Criminal Police Office (BKA), customs and the Federal Police were temporarily offline. In Brandenburg, affected sites included Ernst von Bergmann Hospital, the University of Potsdam and the police\u2019s online service portal. Some portals were <a href=\"https:\/\/www.tagesschau.de\/inland\/regional\/brandenburg\/rbb-it-sicherheitsbehoerde-warnt-vor-kritischer-web-anwender-schwachstelle-php-update-zeigt-luecke-auf-100.html\">back online after 17:00<\/a>. A spokesperson for the Federal Ministry for Digital Affairs said ITZBund, the federal government\u2019s IT service provider, had <a href=\"https:\/\/srnnews.com\/factbox-websites-taken-offline-over-php-risks\/\">taken several websites offline as a precaution<\/a>. No security incidents were&nbsp;known.<\/p>\n<p>In North Rhine-Westphalia, many hospital websites were unavailable, including those in Cologne, Bonn, D\u00fcsseldorf and Bielefeld. Online services run by the State Office for Central Police Services, including online crime reporting, were <a href=\"https:\/\/www1.wdr.de\/nrw\/bsi-warnung-schwachstelle-cybersicherheit-100.html\">unavailable for hours<\/a>. All affected organisations stressed that the shutdowns were&nbsp;precautionary.<\/p>\n<p>The University of Vienna <a href=\"https:\/\/zid.univie.ac.at\/en\/maintenance-work\/article\/praeventive-abschaltung-zentraler-it-services-sicherheitsmassnahme\">shut down central IT services<\/a> and gradually restored them after updating. The Dutch National Cyber Security Centre (NCSC) took <a href=\"https:\/\/www.rijksoverheid.nl\/actueel\/nieuws\/2026\/10\/21\/ncsc-ernstige-kwetsbaarheden-in-php\">its own website offline<\/a>. According to Reuters, the Port of Rotterdam, the government portal Overheid.nl and numerous hospitals followed. France\u2019s prefecture websites went offline, as did Finland\u2019s public government web services. The Czech government followed at 19:00 local time. The Wikimedia Foundation deliberately took <a href=\"https:\/\/diff.wikimedia.org\/2026\/10\/21\/impact-of-php-vulnerabilities-on-wikimedia-tools-and-services\/\">services including Toolforge and Cloud VPS<\/a> offline. In Japan, Prime Minister Sanae Takaichi described temporarily disabling website functions as <a href=\"https:\/\/www.nippon.com\/en\/news\/yjj2026102101249\/\">an effective way<\/a> to reduce the&nbsp;risk.<\/p>\n<p><strong>What is remote code execution?<\/strong> Remote code execution describes a vulnerability that lets an attacker remotely run their own code on another system. If authentication is unnecessary, access to the affected service is sufficient. PHP2Shell affects all PHP installations that handle web&nbsp;requests.<\/p>\n<h2>Official advice to take systems&nbsp;offline<\/h2>\n<p>The US Cybersecurity and Infrastructure Security Agency (CISA) urged immediate patching of PHP systems. Together with the National Security Agency (NSA) and Federal Bureau of Investigation (FBI), it advised <a href=\"https:\/\/www.nextgov.com\/cybersecurity\/2026\/10\/us-agencies-urge-fixes-programming-language-flaws-putting-millions-web-systems-risk\/416726\/\">taking systems offline<\/a> if they could not be secured quickly. CERT-EU recommended <a href=\"https:\/\/cert.europa.eu\/publications\/security-advisories\/2026-018\/pdf\">isolating accessible applications from the public network<\/a> until the fix was installed and verified. The UK\u2019s National Cyber Security Centre (NCSC) called for <a href=\"https:\/\/www.ncsc.gov.uk\/news\/critical-security-issue-affecting-php\">immediate action<\/a> and migration to supported versions. Switzerland\u2019s Federal Office for Cyber Security (BACS) highlighted <a href=\"https:\/\/www.bacs.admin.ch\/it\/warnung-php-it\">applications and devices<\/a> that use PHP as a&nbsp;component.<\/p>\n<div style=\"overflow-x:auto;-webkit-overflow-scrolling:touch;margin:24px 0;\">\n<table style=\"width:100%;min-width:640px;border-collapse:collapse;font-size:0.92em;\">\n<thead style=\"\">\n<tr style=\"border-bottom:2px solid #69d8ed;\">\n<th style=\"text-align:left;padding:12px 14px;\">Fact<\/th>\n<th style=\"text-align:left;padding:12px 14px;\">Source<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">The NSA, FBI and CISA jointly urged organisations to fix both flaws and advised taking systems offline if they could not be secured&nbsp;quickly.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/www.nextgov.com\/cybersecurity\/2026\/10\/us-agencies-urge-fixes-programming-language-flaws-putting-millions-web-systems-risk\/416726\/\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">CERT-EU advises isolating internet-accessible applications from the public network until the fix is installed and verified if immediate patching is&nbsp;impossible.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/cert.europa.eu\/publications\/security-advisories\/2026-018\/pdf\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">CERT.at recommended identifying systems using PHP, scheduling an update window for 16:00 and considering shutting systems down where&nbsp;possible.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/www.cert.at\/de\/aktuelles\/2026\/10\/bevorstehendes-kritisches-php-sicherheitsupdate\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">The UK\u2019s NCSC urged organisations to act immediately. Organisations using any PHP version were affected; those using older versions should migrate to a supported&nbsp;version.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/www.ncsc.gov.uk\/news\/critical-security-issue-affecting-php\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">Switzerland\u2019s Federal Office for Cyber Security (BACS) advises updating affected systems immediately and checking applications and devices that use PHP as a component, alongside web&nbsp;servers.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/www.bacs.admin.ch\/it\/warnung-php-it\">Source<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>PHP powers <a href=\"https:\/\/w3techs.com\/technologies\/details\/pl-php\">69.3 percent of all websites<\/a> whose server-side programming language is known. <a href=\"https:\/\/www.php.net\/archive\/2026.php\">All PHP installations handling web requests<\/a> are affected. PHP 8.1 and earlier receive no official fixed releases. For 7.4, 8.0 and 8.1, the PHP security team provided minimal <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\">source-code backports<\/a>, fixes transferred as source code to older release branches. Some distributions and long-term support (LTS) providers also supply patched&nbsp;packages.<\/p>\n<p>The details <a href=\"https:\/\/threatlandscape.io\/blog\/php-core-rce-cve-2026-109618-109619-leak-ahead-of-embargo\">leaked on Tuesday ahead of coordinated disclosure<\/a>. According to watchTowr, the embargo, the agreed deadline before publication, was set for Thursday. CISA <a href=\"https:\/\/www.nextgov.com\/cybersecurity\/2026\/10\/us-agencies-urge-fixes-programming-language-flaws-putting-millions-web-systems-risk\/416726\/\">said it had observed<\/a> no exploitation by the time of&nbsp;publication.<\/p>\n<h2>Old flaws and AI&nbsp;tools<\/h2>\n<p>The pair of vulnerabilities is nicknamed PHP2Shell, echoing Log4Shell. Wiz.io and Calif.io discovered them, with OpenAI involved. According to Wiz Research, frontier AI models, the most capable AI systems available, helped identify the flaws and make them exploitable. The flaws had reportedly been <a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\">in the code for more than a decade<\/a>, affecting versions as far back as PHP 5.4. Wiz believes that without AI, the attack chain would have approached the limits of what human researchers could practically&nbsp;achieve.<\/p>\n<p>The same day, GitLab fixed a flaw in the compilation of regular expressions, patterns used to search text. It has <a href=\"https:\/\/docs.gitlab.com\/releases\/patches\/patch-release-gitlab-19-5-1-released\/\">a Common Vulnerability Scoring System (CVSS) score of 10.0<\/a> and allows unauthenticated attackers to execute code on the server under certain conditions. All versions from 7.0 onwards are affected. Version 7.0 was released <a href=\"https:\/\/gitlab.com\/gitlab-org\/gitlab-foss\/-\/tags\/v7.0.0\">in June 2014<\/a>, dating the flaw back twelve years. Node.js released <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\">updates for branches 22.x, 24.x and 26.x<\/a>, addressing issues including remote code execution in the Brotli decoder for compressed&nbsp;data.<\/p>\n<h2>Attacks on developer&nbsp;platforms<\/h2>\n<p><a href=\"https:\/\/github.com\/BerriAI\/litellm\/issues\/47826\">Version 1.107.0 of the LiteLLM AI gateway library<\/a> was compromised. All wheels on PyPI, the ready-to-install packages in the Python package repository, contained a credential stealer, a program that harvests access credentials. It ran whenever the Python interpreter started, collecting SSH keys, cloud credentials for AWS, Azure and Google Cloud, and Kubernetes tokens, among other data. LiteLLM <a href=\"https:\/\/docs.litellm.ai\/blog\/security-incident-oct-21-2026\">confirmed the incident had been contained<\/a>. Versions 1.82.7 and 1.82.8 had already been compromised <a href=\"https:\/\/github.com\/BerriAI\/litellm\/issues\/24518\">in March 2026<\/a>.<\/p>\n<div style=\"overflow-x:auto;-webkit-overflow-scrolling:touch;margin:24px 0;\">\n<table style=\"width:100%;min-width:640px;border-collapse:collapse;font-size:0.92em;\">\n<thead style=\"\">\n<tr style=\"border-bottom:2px solid #69d8ed;\">\n<th style=\"text-align:left;padding:12px 14px;\">Fact<\/th>\n<th style=\"text-align:left;padding:12px 14px;\">Source<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">Version 1.107.0 of the LiteLLM AI gateway library was compromised: all wheels on PyPI contained a credential stealer and a loader for external code, which run automatically whenever the Python interpreter starts, without requiring LiteLLM to be imported. The Docker tags latest, main-latest and main-stable were also&nbsp;affected.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/github.com\/BerriAI\/litellm\/issues\/47826\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">Hosting platform Railway reported that an unauthorised party may have accessed customers\u2019 encrypted environment variables and decrypted some of them. Railway paused all deployments and advised all users to rotate every environment variable, API key and registry credential stored on its&nbsp;platform.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/blog.railway.com\/p\/security-disclosure-wednesday-october-21st\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">Zeabur announced its closure on its blog, citing a second security incident. The first services will end on 1 December 2026, with all dedicated servers and shared clusters closing by 31 December&nbsp;2026.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/zeabur.com\/blogs\/zeabur-is-shutting-down\">Source<\/a><\/td>\n<\/tr>\n<tr style=\"border-bottom:1px solid rgba(230,227,218,0.12);\">\n<td style=\"padding:11px 14px;\">According to PingCAP, the copied records included usernames, email addresses, contract and pricing data, and a table containing encrypted API keys for TiDB Cloud. PingCAP has not confirmed the attackers\u2019 claims concerning additional&nbsp;credentials.<\/td>\n<td style=\"padding:11px 14px;\"><a href=\"https:\/\/www.pingcap.com\/trust-hub\/security\/security-update-october-2026\/\">Source<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>At hosting platform Railway, an unauthorised party may have accessed customers\u2019 encrypted environment variables and <a href=\"https:\/\/blog.railway.com\/p\/security-disclosure-wednesday-october-21st\">decrypted some of them<\/a>, according to the company. Environment variables are configuration values a platform passes to applications. Railway paused all deployments and advised all users to rotate every variable, API key and registry credential stored there. The company links the incident to a series of attacks on platform companies targeting AI inference&nbsp;providers.<\/p>\n<p>Zeabur <a href=\"https:\/\/zeabur.com\/blogs\/zeabur-is-shutting-down\">confirmed its second security incident in two months on 17 October<\/a>. An attacker used internal credentials stored in plaintext to steal data from <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/zeabur-shutting-down-after-second-security-breach-in-two-months\/\">321,810 accounts<\/a> and around 3.2 million environment-variable records. The admin tokens had not been rotated since January 2024. The platform will shut down by the end of December 2026. At PingCAP, an unauthorised party used stolen service-account credentials to access internal systems <a href=\"https:\/\/www.pingcap.com\/trust-hub\/security\/security-update-october-2026\/\">between 9 September and 7 October 2026<\/a>, copying data including encrypted API keys for TiDB&nbsp;Cloud.<\/p>\n<h2>Three preparations before the next critical&nbsp;flaw<\/h2>\n<p>When BSI issued its warning, there was no confirmed exploitation of PHP2Shell, although unconfirmed reports suggested exploits existed. IT managers can prepare three things before the next vulnerability of this&nbsp;kind.<\/p>\n<p>&#8211; <strong>Inventory PHP beyond the web server.<\/strong> BACS advised checking applications and devices that use PHP as a component. An up-to-date list of these systems speeds up searches in an emergency. &#8211; <strong>Fallback operations for websites and portals.<\/strong> On Wednesday, North Rhine-Westphalia\u2019s online crime-reporting service was down for hours, while Brandenburg\u2019s police portal and many hospital websites were unavailable. During its shutdown, the Dutch NCSC directed users to advisories.ncsc.nl and LinkedIn. Such alternatives for citizens and customers should be established before an alert. &#8211; <strong>Secrets with expiry dates.<\/strong> Railway advised all users to rotate their stored keys. At Zeabur, admin tokens never expired and had remained unchanged since January 2024. Short lifetimes and regular rotation limit the damage when a platform provider loses data. Stolen or guessed passwords are also among the <a href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa26-293a\">entry points used by the ransomware group SafePay<\/a>, which the FBI, CISA and Rhineland-Palatinate\u2019s State Criminal Police Office (LKA) jointly warned about on&nbsp;Tuesday.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently asked questions<\/h2>\n<p class=\"st-faq-hint\">Each question is locked. Tap to unlock the answer.<\/p>\n<details>\n<summary><strong>Which PHP versions fix&nbsp;PHP2Shell?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">On 21 October 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix vulnerabilities CVE-2026-109618 and&nbsp;CVE-2026-109619.<\/p>\n<\/details>\n<details>\n<summary><strong>Which GitLab versions include the&nbsp;fix?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is already patched; self-managed installations should be updated&nbsp;immediately.<\/p>\n<\/details>\n<details>\n<summary><strong>Which LiteLLM artefacts were&nbsp;compromised?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Alongside the version 1.107.0 wheels on PyPI, Docker tags latest, main-latest and main-stable were affected. Package 1.107.0 was withdrawn from PyPI and Docker image v1.107.0 was removed. The latest, main-latest and main-stable tags point to safe images&nbsp;again.<\/p>\n<\/details>\n<aside data-element=\"sources\">\n<details class=\"evm-sources\">\n<summary>Sources and reporting dates <span class=\"evm-sources-count\">(28)<\/span><\/summary>\n<ul>\n<li><a href=\"https:\/\/www.bsi.bund.de\/SharedDocs\/Cybersicherheitswarnungen\/DE\/2026\/2026-297981-1032.html\" rel=\"noopener\" target=\"_blank\">Federal Office for Information Security: Version 1.1: PHP &#8211; Critical vulnerabilities threaten web applications worldwide, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.cert.at\/de\/aktuelles\/2026\/10\/bevorstehendes-kritisches-php-sicherheitsupdate\" rel=\"noopener\" target=\"_blank\">cert.at: CERT.at &#8211; Show, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.tagesschau.de\/inland\/regional\/brandenburg\/rbb-it-sicherheitsbehoerde-warnt-vor-kritischer-web-anwender-schwachstelle-php-update-zeigt-luecke-auf-100.html\" rel=\"noopener\" target=\"_blank\">tagesschau.de: Brandenburg Berlin: IT vulnerability: Many authorities and companies take websites offline, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/srnnews.com\/factbox-websites-taken-offline-over-php-risks\/\" rel=\"noopener\" target=\"_blank\">SRN News: Factbox-Websites taken offline over PHP risks, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www1.wdr.de\/nrw\/bsi-warnung-schwachstelle-cybersicherheit-100.html\" rel=\"noopener\" target=\"_blank\">www1.wdr.de: BSI warns of impending wave of cyberattacks: Numerous websites in North Rhine-Westphalia offline as a precaution, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/zid.univie.ac.at\/en\/maintenance-work\/article\/praeventive-abschaltung-zentraler-it-services-sicherheitsmassnahme\" rel=\"noopener\" target=\"_blank\">Central IT Service: UPDATE: Precautionary shutdown of central IT services (security measure), October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.rijksoverheid.nl\/actueel\/nieuws\/2026\/10\/21\/ncsc-ernstige-kwetsbaarheden-in-php\" rel=\"noopener\" target=\"_blank\">rijksoverheid.nl: NCSC: Serious vulnerabilities in PHP | Rijksoverheid.nl, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/diff.wikimedia.org\/2026\/10\/21\/impact-of-php-vulnerabilities-on-wikimedia-tools-and-services\/\" rel=\"noopener\" target=\"_blank\">Diff: Impact of PHP vulnerabilities on Wikimedia tools and services, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.nippon.com\/en\/news\/yjj2026102101249\/\" rel=\"noopener\" target=\"_blank\">nippon.com: Japan PM Warns of Vulnerabilities in PHP Programming Language, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.nextgov.com\/cybersecurity\/2026\/10\/us-agencies-urge-fixes-programming-language-flaws-putting-millions-web-systems-risk\/416726\/\" rel=\"noopener\" target=\"_blank\">Nextgov.com: US agencies urge fixes for programming language flaws putting millions of web systems at risk, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/cert.europa.eu\/publications\/security-advisories\/2026-018\/pdf\" rel=\"noopener\" target=\"_blank\">cert.europa.eu: Isolate from the public network, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/news\/critical-security-issue-affecting-php\" rel=\"noopener\" target=\"_blank\">National Cyber Security Centre: Critical security issue affecting PHP, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bacs.admin.ch\/it\/warnung-php-it\" rel=\"noopener\" target=\"_blank\">bacs.admin.ch: Critical vulnerabilities in PHP: Install security updates immediately, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/w3techs.com\/technologies\/details\/pl-php\" rel=\"noopener\" target=\"_blank\">w3techs.com: Usage Statistics and Market Share of PHP for Websites, October 2026, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php\" rel=\"noopener\" target=\"_blank\">php.net: PHP: News Archive &#8211; 2026, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/threatlandscape.io\/blog\/php-core-rce-cve-2026-109618-109619-leak-ahead-of-embargo\" rel=\"noopener\" target=\"_blank\">Threat Landscape: PHP Core RCEs CVE-2026-109618 and CVE-2026-109619 Leak Early, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\" rel=\"noopener\" target=\"_blank\">wiz.io: PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/docs.gitlab.com\/releases\/patches\/patch-release-gitlab-19-5-1-released\/\" rel=\"noopener\" target=\"_blank\">GitLab Docs: GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/gitlab.com\/gitlab-org\/gitlab-foss\/-\/tags\/v7.0.0\" rel=\"noopener\" target=\"_blank\">GitLab: v7.0.0 \u00b7 Tags, June&nbsp;2014<\/a><\/li>\n<li><a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\" rel=\"noopener\" target=\"_blank\">nodejs.org: Node.js &#8211; Wednesday, October 21, 2026 Security Releases, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/BerriAI\/litellm\/issues\/47826\" rel=\"noopener\" target=\"_blank\">GitHub: [SECURITY] litellm 1.107.0 compromised (PyPI removed; Docker latest\/main-stable removed): cook.pth \u2026, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/docs.litellm.ai\/blog\/security-incident-oct-21-2026\" rel=\"noopener\" target=\"_blank\">docs.litellm.ai: Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised | liteLLM, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/BerriAI\/litellm\/issues\/24518\" rel=\"noopener\" target=\"_blank\">GitHub: [Security]: litellm PyPI package (v1.82.7 + v1.82.8) compromised &#8211; full timeline and status \u00b7 Issue #24518 \u2026, March&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/blog.railway.com\/p\/security-disclosure-wednesday-october-21st\" rel=\"noopener\" target=\"_blank\">Railway Blog: Security Disclosure: Wednesday October 21st, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/zeabur.com\/blogs\/zeabur-is-shutting-down\" rel=\"noopener\" target=\"_blank\">Zeabur: Blogs, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/zeabur-shutting-down-after-second-security-breach-in-two-months\/\" rel=\"noopener\" target=\"_blank\">BleepingComputer: Zeabur shutting down after second security breach in two months, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.pingcap.com\/trust-hub\/security\/security-update-october-2026\/\" rel=\"noopener\" target=\"_blank\">TiDB: Security Update &#8211; October 2026 Security Incident Report: Unauthorized Access to PingCAP Cloud Resources, October&nbsp;2026<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa26-293a\" rel=\"noopener\" target=\"_blank\">Cybersecurity and Infrastructure Security Agency CISA: #StopRansomware: SafePay Ransomware | CISA, October&nbsp;2026<\/a><\/li>\n<\/ul>\n<\/details>\n<\/aside>\n<p><!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/19\/when-the-security-stack-outgrows-the-strategy\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/security-strategie-vor-dem-tool-kauf-cover-hero-250x140.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">When the Security Stack Outgrows the Strategy<\/span><\/span><\/a><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/10\/14\/google-counters-meta-with-top-tier-ai-at-half-the-price\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/net-google-kontert-meta-mit-spitzen-ki-zum-h-23817082.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Google counters Meta with top AI at half the price<\/span><\/span><\/a><a href=\"https:\/\/www.digital-chiefs.de\/en\/microsoft-germany-tops-eu-in-cyberattacks\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><img decoding=\"async\" src=\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/10\/net-microsoft-deutschland-ist-eu-spitze-bei-91597426-250x141.jpg\" alt=\"\" loading=\"lazy\" width=\"116\" height=\"65\" style=\"width:100%;height:100%;object-fit:cover;display:block;\"><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#e8828d;margin-bottom:5px;\">Digital Chiefs<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Microsoft: Germany Is EU\u2019s Top Cyberattack Target<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n<p style=\"font-style:italic;text-align:right;font-size:0.85em;margin-top:8px;\">Image source: AI-generated (October 2026)<\/p>\n","protected":false},"excerpt":{"rendered":"Two PHP flaws could allow code execution without authentication. Websites from Berlin and Vienna to Rotterdam were taken offline as a precaution.","protected":false},"author":10,"featured_media":25073,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"PHP flaws","_yoast_wpseo_title":"PHP flaws: Security agencies advise taking sites offline","_yoast_wpseo_metadesc":"Two PHP flaws could allow code execution without authentication. Websites from Berlin and Vienna to Rotterdam were taken offline as a precaution.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[251],"tags":[],"class_list":["post-25123","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"evm_reading_time_minutes":11,"wpml_language":"en","wpml_translation_of":25069,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=25123"}],"version-history":[{"count":8,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25123\/revisions"}],"predecessor-version":[{"id":25189,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/25123\/revisions\/25189"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/25073"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=25123"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=25123"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=25123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}