Security
DENIC Ausfall mit deutschlandweiter Störung für „.de“-Domains
Am 05.05.2026 gegen 21:40 Uhr kam es aufgrund einer DNSSEC-Störung bei der Registrierungsstelle DENIC zu einem deutschlandweiten…
PHP is one of the most important building blocks of the internet. A large share of all websites, shops and web applications worldwide runs on it. That makes the current warning from the German Federal Office for Information Security (BSI) all the more serious: two critical security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) could allow attackers to execute malicious code on web servers remotely, without authentication and without any user interaction.
The good news for our managed server customers: On all managed servers with supported and maintained PHP versions, the security updates have already been installed.
According to the BSI, all known PHP versions going back to at least PHP 5 are affected. The agency expects attacks to follow quickly, because attackers can use AI-assisted tools to analyse the patches in a short time and develop exploits from them. The PHP developers released the updates on 21 October at 4 p.m. German time. We responded immediately and installed the patches that same night as part of our patch day.
What does this mean for centron customers?
If you use a managed server with supported and maintained PHP versions at centron, you do not need to do anything. We have installed the security updates there automatically. The maintenance took place between 10 p.m. and 4 a.m.
If you run unmanaged servers with us or several PHP versions in parallel on your managed systems, please check now whether all updates are installed – or whether you can install them without loss of functionality. Check which web applications and servers use PHP. Remember PHP applications in Docker containers and embedded components as well. The BSI also recommends monitoring publicly accessible PHP web servers particularly closely for anomalies over the next few days.
You can find all details and ongoing updates on our status page.
Source: BSI cyber security warning “PHP – Kritische Schwachstellen bedrohen Webanwendungen weltweit” (21 October 2026, in German).
