It has now been confirmed that these critical PHP security vulnerabilities are being successfully exploited. At EGOTEC, security updates have been completed for all customer installations under our management. We were also able to migrate older systems – for which regular PHP security updates were no longer available – to a current system environment running PHP 8.5 at short notice.
First successful PHP2Shell attacks confirmed
On 21 October 2026, the two critical PHP security vulnerabilities CVE-2026-109618 and CVE-2026-109619 were disclosed. Both were assigned a CVSS score of 9.2 and, under certain conditions, allow malicious code to be executed on affected web servers.
Numerous automated attack attempts were observed worldwide immediately following the disclosure.
It is now clear that the threat is no longer merely theoretical.
As heise online reported on 27 October, security researchers were able to confirm the first successful attacks on so-called honeypots. These are specially set-up systems used to monitor and analyse attack attempts.
The US Cybersecurity and Infrastructure Security Agency (CISA) has also since added the vulnerabilities to its catalogue of known exploited security flaws.
These developments confirm how important it is to update affected PHP installations as soon as possible.
All customer installations managed by EGOTEC have been updated
As early as 21 October 2026, we were able to provide an updated Docker image – EGOCMS V26.3.4.2 – containing the necessary PHP security updates.
Immediately afterwards, we updated the customer installations we manage as a matter of the highest priority.
On the evening of 21 October and during the following night, we successfully updated all client installations to PHP versions 8.2 and above.
In the meantime, all client installations that were previously still running on older PHP versions have also been migrated to current, secure system environments at short notice.
This enabled us to complete the necessary security measures even before the first successful attacks were publicly confirmed.
It was particularly important to us that not only our current EGOCMS installations were taken into account, but also older client systems.
A particular challenge: Outdated PHP versions
A small number of customer installations were still running on older PHP versions, for which the manufacturer no longer provides regular security updates.
We had been advising the affected customers for years to upgrade their systems to a current version. However, the necessary upgrades had been repeatedly postponed for various reasons.
Fortunately, we had already begun migrating most of these customers to a current EGOCMS environment.
However, the sudden discovery of security vulnerabilities fundamentally changed the situation: what had originally been planned as a routine migration had to be implemented within a very short timeframe.
Simply installing the new PHP security updates was not possible on these outdated systems. Instead, we had to complete the migrations at short notice.
Exceptional commitment from our team
To secure these client installations as quickly as possible, we mobilised all available resources.
To do so, we even had to contact some staff members who were on holiday.
Together, we accelerated the ongoing migrations, made the necessary adjustments and, in some cases working night shifts, went live with the affected client websites on the new systems.
The initial priority was to ensure the safe resumption of regular operations. The security-related migrations have now been completed. Individual functional adjustments and optimisations are being carried out as part of the regular follow-up work.
Thanks to the exceptional dedication of our team, we were also able to successfully migrate these particularly demanding client installations to up-to-date environments equipped with the latest security updates.
We would like to express our sincere thanks to all the staff members involved.
Why regular updates are essential
The recent PHP security vulnerabilities clearly demonstrate the risks associated with the long-term use of outdated software versions.
As long as a PHP version continues to receive security updates from the manufacturer, newly discovered vulnerabilities can usually be resolved through appropriate updates.
With versions that are no longer supported, this is often no longer possible. In such cases, a more extensive migration to a current system environment may be required.
Under normal circumstances, such migrations can be carefully planned, tested and carried out in collaboration with the client.
In an acute security situation, however, there is often very little time available for this.
Our recommendation is therefore: do not unnecessarily delay essential software updates and migrations.
Regularly updating your systems reduces security risks and avoids costly emergency measures.
Security, availability and transparency
At EGOTEC, our customers’ security is our top priority.
That is why we reacted on the very day the security vulnerabilities were announced, provided an updated Docker image and kept our customers continuously informed about the situation.
Even with the particularly complex migrations of older installations, we have done everything in our power to implement the necessary security measures quickly.
The current status is encouraging:
All EGOCMS customer installations managed by us have been updated and the necessary security measures have been completed.
The now confirmed successful attacks on vulnerable PHP systems demonstrate that swift action was essential.
We would like to thank our entire team and all our customers who supported us with these short-notice measures.
Further information on the timeline and our technical security measures can be found in our previous posts:
- Critical PHP security vulnerabilities: We responded immediately
- Critical PHP security vulnerabilities
EGOTEC AG – secure software, reliable operation and a swift response when it matters most.