# Security alerts: current warnings for businesses > Current security warnings, briefly explained for businesses: what happened, who is affected and what to do. Always with sources, for example the BSI. Current: critical PHP vulnerability of 21 Oct 2026. Source: https://1x1it.de/en/it-support/sicherheitshinweise/ When the BSI (Germany’s Federal Office for Information Security) or a vendor warns of a serious security vulnerability, we summarise here what happened, who is affected and what you should do. Short, clear and always with sources. Read the current alert Get alerts by email Status as of 21 Oct 2026 - **Current:** 1 critical alert - **Latest:** PHP, vulnerabilities in web servers - **Source:** BSI, press release of 21 Oct - **Affects:** websites, shops, portals running PHP ## Current alerts The newest alert is at the top. Each alert has its own address that you can pass on. Critical 21 October 2026 Source: BSI ### PHP: critical vulnerabilities, install the update now The German Federal Office for Information Security (BSI) warns of two critical vulnerabilities in the PHP programming language. Attackers could use them to run malicious code on web servers remotely. The BSI expects widespread exploitation within a few hours of the updates being released. - **Affected:** Web servers running PHP, for example websites with WordPress, online shops and many customer portals. According to the BSI, all known PHP versions are affected. - **Vulnerabilities:** CVE-2026-109618 and CVE-2026-109619 - **Fixed in:** PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions ship their own updates. PHP 8.1 and older no longer receive official updates. - **Workaround:** According to the PHP developers, none that is complete. Only the update protects you. - 21 Oct The BSI issues a warning and calls for the update to be installed the same day. - 21 Oct, 4 pm The PHP developers release the updates. #### What you should do now - Ask your web host or service provider whether the PHP update has been installed on your server. - If you run your own server, install the update immediately and restart PHP. - If your website still runs on PHP 8.1 or older, plan the move to a supported version. - Watch for anything unusual over the next few days, such as unknown files or users on the website. Not sure whether your website is affected? [Get in touch](https://1x1it.de/en/kontakt/#anfrage) and we will take a look. Sources - German Federal Office for Information Security (BSI): “PHP: BSI warnt vor kritischen Schwachstellen – Sicherheitsupdate noch heute notwendig”, press release of 21 Oct 2026 (German). [bsi.bund.de](https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2026/261021_PHP-kritische-Schwachstelle.html) - The PHP Group: security releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 of 21 Oct 2026. [php.net](https://www.php.net/) ## Security alerts by email When there is a serious warning, you get a short email with the essentials and a link to the full alert on this page. Irregular, only when needed. The emails are in German. - Only real warnings, no advertising - Sent through our own mail server, without tracking - Unsubscribe with one click, in every email Email Name (optional) Company (optional) Website Consent text (German, binding): Ja, ich möchte die Sicherheitshinweise von 1x1 IT-Solutions per E-Mail erhalten: aktuelle Warnungen zu Sicherheitslücken und wichtigen Updates, unregelmäßig und nur bei Bedarf. Meine Einwilligung kann ich jederzeit über den Abmeldelink in jeder E-Mail widerrufen. Hinweise zum Datenschutz: [1x1it.de/datenschutz/](https://1x1it.de/datenschutz/) Ich bin außerdem einverstanden, dass mich 1x1 IT-Solutions per E-Mail zu passenden IT-Leistungen kontaktiert (freiwillig, jederzeit widerrufbar). Subscribe You will first receive an email to confirm. ## Security alerts as push notifications on your phone No sign-up and no email address: every released alert arrives as a notification on your phone, with title, summary and a link to the alert on this page. We do not learn who subscribes to the channel. The notifications are in German. - Install the app: The free app “ntfy” is available for Android on [Google Play](https://play.google.com/store/apps/details?id=io.heckel.ntfy) and [F-Droid](https://f-droid.org/packages/io.heckel.ntfy/), and for iPhone in the [App Store](https://apps.apple.com/app/ntfy/id1625396347). - Subscribe to the channel: In the app, tap “+”, enable “Use another server” and enter: server https://push.1x1it.de , topic sicherheitshinweise . Or scan the QR code. - On a computer: It also works in the browser: open [push.1x1it.de/sicherheitshinweise](https://push.1x1it.de/sicherheitshinweise) and allow notifications. Unsubscribe at any time in the app. More in the [privacy policy](https://1x1it.de/en/datenschutz/#push). Scan with the ntfy app or your phone camera ## How to read the alerts Every alert carries a level. It shows at a glance how quickly you should act. - Critical Act immediately: The vulnerability is being exploited or is likely to be soon. Install the update the same day. - High Act soon: A serious vulnerability, but with limitations. Plan the update within the next few days. - Notice For your information: Scams, versions reaching end of support, or changes you should know about. ## So you do not have to follow every warning yourself With a maintenance contract we keep an eye on updates, backups and antivirus on your devices for you. You keep working, we take care of the rest. [See packages and prices](https://1x1it.de/en/it-support/wartungsvertrag/) [Maintenance contract Cancellable monthly, with monitoring](https://1x1it.de/en/it-support/wartungsvertrag/) [Updates & migration Planned changeovers](https://1x1it.de/en/it-support/updates-migration/) [Backup & security Backups you can restore](https://1x1it.de/en/it-support/backup/) [Emergency hotline For maintenance customers](https://1x1it.de/en/it-support/notfall-hotline/) ## Not sure whether your systems are affected? Call or write to us. We will take a look, even without a maintenance contract. [0173 644 22 17](tel:+491736442217) [Ask us](https://1x1it.de/en/kontakt/#anfrage)