Start remote support Customer portal Shop 0173 644 22 17 DeutschDE

Security alerts: what matters right now.

When the BSI (Germany’s Federal Office for Information Security) or a vendor warns of a serious security vulnerability, we summarise here what happened, who is affected and what you should do. Short, clear and always with sources.

Read the current alert Get alerts by email
Patch panel in a server cabinet

Current alerts

The newest alert is at the top. Each alert has its own address that you can pass on.

Critical Source: BSI

PHP: critical vulnerabilities, install the update now

The German Federal Office for Information Security (BSI) warns of two critical vulnerabilities in the PHP programming language. Attackers could use them to run malicious code on web servers remotely. The BSI expects widespread exploitation within a few hours of the updates being released.

Affected
Web servers running PHP, for example websites with WordPress, online shops and many customer portals. According to the BSI, all known PHP versions are affected.
Vulnerabilities
CVE-2026-109618 and CVE-2026-109619
Fixed in
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions ship their own updates. PHP 8.1 and older no longer receive official updates.
Workaround
According to the PHP developers, none that is complete. Only the update protects you.
  1. The BSI issues a warning and calls for the update to be installed the same day.
  2. The PHP developers release the updates.

What you should do now

  • Ask your web host or service provider whether the PHP update has been installed on your server.
  • If you run your own server, install the update immediately and restart PHP.
  • If your website still runs on PHP 8.1 or older, plan the move to a supported version.
  • Watch for anything unusual over the next few days, such as unknown files or users on the website.

Not sure whether your website is affected? Get in touch and we will take a look.

Sources
  • German Federal Office for Information Security (BSI): “PHP: BSI warnt vor kritischen Schwachstellen – Sicherheitsupdate noch heute notwendig”, press release of 21 Oct 2026 (German). bsi.bund.de
  • The PHP Group: security releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 of 21 Oct 2026. php.net

Security alerts by email

When there is a serious warning, you get a short email with the essentials and a link to the full alert on this page. Irregular, only when needed. The emails are in German.

  • Only real warnings, no advertising
  • Sent through our own mail server, without tracking
  • Unsubscribe with one click, in every email

Consent text (German, binding):

You will first receive an email to confirm.

Security alerts as push notifications on your phone

No sign-up and no email address: every released alert arrives as a notification on your phone, with title, summary and a link to the alert on this page. We do not learn who subscribes to the channel. The notifications are in German.

  1. Install the appThe free app “ntfy” is available for Android on Google Play and F-Droid, and for iPhone in the App Store.
  2. Subscribe to the channelIn the app, tap “+”, enable “Use another server” and enter: server https://push.1x1it.de, topic sicherheitshinweise. Or scan the QR code.
  3. On a computerIt also works in the browser: open push.1x1it.de/sicherheitshinweise and allow notifications.

Unsubscribe at any time in the app. More in the privacy policy.

QR code for the channel https://push.1x1it.de/sicherheitshinweise
Scan with the ntfy app or your phone camera

How to read the alerts

Every alert carries a level. It shows at a glance how quickly you should act.

  • CriticalAct immediatelyThe vulnerability is being exploited or is likely to be soon. Install the update the same day.
  • HighAct soonA serious vulnerability, but with limitations. Plan the update within the next few days.
  • NoticeFor your informationScams, versions reaching end of support, or changes you should know about.

So you do not have to follow every warning yourself

With a maintenance contract we keep an eye on updates, backups and antivirus on your devices for you. You keep working, we take care of the rest.

See packages and prices

Not sure whether your systems are affected?

Call or write to us. We will take a look, even without a maintenance contract.

0173 644 22 17
Ask us