Current status: An updated Docker image containing the PHP security updates for EGOCMS V26 has been available since 21 October 2026 at 16:31. Further information can be found at the end of this article.
On 21 October 2026, important PHP security updates will be released to address two critical vulnerabilities. These could, under certain circumstances, allow malicious code to be executed remotely. Further information is available on heise Security.
EGOTEC AG is aware of the security issue and is responding immediately.
As full technical details of the vulnerabilities are not yet available, we are currently unable to conclusively assess the extent to which EGOCMS is affected.
For the current EGOCMS version 26, we will update and make available the affected container images as soon as the PHP security updates are released.
Due to the high severity of the vulnerabilities (CVSS 9.2), we recommend that all customers check the PHP version they are using as a matter of urgency and install any available security updates without delay.
We strongly advise customers still using PHP 8.1 or older versions to update to a currently supported PHP version. These older PHP versions no longer receive regular security updates. An overview of supported versions can be found on the official PHP roadmap.
Please contact our EGOCMS Support team beforehand. A PHP update may require EGOCMS to be updated as well. In addition, project scripts must be checked and, if necessary, adapted. Our sales team will be happy to provide you with a quote.
We treat enquiries regarding support for these security-critical updates as a top priority.
Update 21 October 2026, 2.15 pm
Through the Alliance for Cyber Security, we have now also been officially warned about the PHP security vulnerabilities by the Federal Office for Information Security (BSI).
The BSI has classified the threat as Criticality Level 3 (Orange) and recommends immediate security measures.
No confirmed attacks have been reported so far. However, the BSI considers it likely that the vulnerabilities will be widely exploited within a few hours of the security updates being released.
The release of the PHP security updates is scheduled for today at 4.00 pm.
Update 21 October 2026, 3.38 pm
PHP has published the updates online. We are currently assessing the security vulnerabilities.
Update 21 October 2026, 4.09 pm (updated at 5.13 pm and 5.24 pm)
The PHP project has now published further technical details regarding the two critical security vulnerabilities and released the relevant security updates.
As a short-term protective measure for our customers, we are changing the following PHP configurations:
-
session.upload_progress.enabled = Off – Disabling PHP upload progress handling
-
post_max_size = 8M – Limiting the maximum POST data size to 8 MB
-
memory_limit = -1 – Disabling the PHP internal memory limit
(max_input_nesting_level = 8 – This setting limits the nesting of input data, for example in form parameters such as a[b][c]. This setting may affect the caching of pages!)
These measures are based on the official recommendations of the PHP project and significantly reduce known attack vectors.
These measures represent a temporary safeguard and do not replace the necessary PHP security updates.
Updating our container images to the patched PHP versions is being treated as a top priority.
Further technical information and recommendations can be found in the PHP Project’s official security advisory.
Update 21 October 2026, 4.20 pm
We are currently preparing a new Docker image for EGOCMS V26 containing the PHP security patches.
Update 21 October 2026, 4.31 pm – Security update available
The updated Docker image for EGOCMS V26 is now available.
With EGOCMS V26.3.4.2, we are providing an updated container image that includes the PHP security updates to address the critical vulnerabilities.
We recommend that all customers using our Docker images update to EGOCMS V26.3.4.2 immediately.
We have already begun updating our maintenance customers’ systems. Due to the large number of installations, the updates are being carried out in stages and with the highest priority.
Please note: If you are running EGOCMS without our Docker image, simply updating to EGOCMS V26.3.4.2 will not be sufficient to fix the PHP security vulnerabilities. In this case, you must update your PHP installation with the relevant security updates. No additional EGOCMS update is required to fix these PHP security vulnerabilities.
Update 21 October 2026, 17:52
As a precautionary measure, we have temporarily taken all Matomo instances hosted on our servers offline. The affected PHP versions are scheduled to be updated on 22 October 2026. The services will then be brought back online.