Blog

All customer installations managed by EGOTEC have been updated!

It has now been confirmed that the critical PHP security vulnerabilities are being successfully exploited. EGOTEC has now completed the security updates for all client installations under its management. We were also able to migrate older systems – for which regular PHP security updates were no longer available – to a current system environment running PHP 8.5 at short notice.

The Nginx rate limit is temporarily not included in the Docker image.

Two critical security vulnerabilities, millions of web servers potentially affected, and the risk that attackers could execute malicious code remotely. Our hosted customers already had protection in place: rate limiting, which had been in use for a long time.

The second line of defence: up-to-date systems that could be updated quickly.

The Docker image includes the latest PHP security patches.

An updated Docker image containing the PHP security updates has been available for EGOCMS V26 since 21 October 2026 at 16:31.

Please note: If you are running EGOCMS without our Docker image, simply updating to EGOCMS V26.3.4.2 will not be sufficient to patch the PHP security vulnerabilities. In this case, you must update your PHP installation with the relevant security updates or, as a short-term workaround, at least adjust the PHP configuration.

Update 22 October 2026, 07:05

All customer websites hosted by us are running smoothly following yesterday’s security updates. No disruptions to ongoing operations have been observed.

A bug has been fixed for the Image and Folder input plugins.

The sitemap status is now tracked across multiple input plugins. The newsletter registration process has been optimised so that users can complete the process even if they no longer have the initial confirmation email. A rate limit has been set up for PDF Miner. In addition, various bugs have been fixed, such as the display of rotated images at smaller sizes.

A search via Elasticsearch can now de-prioritise older results and give preference to more recent ones. The chatbot system prompt can be optionally extended, and pages can be selected whose sections are used exclusively for source searches. Some classes have been optimised for use in in-house developments. In addition, bugs have been fixed, such as the correct display of dialogues in certain viewports and the transfer of individual pages with a large number of subpages.

OpenID 2.0 authentication can now also be enhanced with two-factor authentication.

The process of clearing the type cache when using APCu has been optimised. In addition, translation errors in the admin area have been rectified and other bugs have been fixed.