Description
We're aware of upcoming critical PHP security updates to be released today (2026-10-21).
As soon as the releases are out, we'll immediately start updating affected systems during the day.
We'll update this issue as needed.
Timeline
- 2026-10-20 21:00 - we started investigating
- 2026-10-21 11:00 - initial publication of this incident + waiting for official PHP information/releases
- 2026-10-21 13:00 - we're still waiting for the release PHP versions containing the hotfixes
- 2026-10-21 13:40 - for customers that want to reduce risks before the roll-out of new versions, we offer to stop web servers on managed servers for the time until the PHP updates are applied (upon request, please contact us)
- 2026-10-21 13:44 - we decided to temporarily shut down certain managed applications (Nextcloud, Matomo, LimeSurvey) as a precaution until the updated PHP versions are rolled-out
- 2026-10-21 15:50 - PHP has published updates. We are currently building and rolling out the packages
- 2026-10-21 16:44 - Nextcloud installations are online again
- 2026-10-21 18:25 - Matomo installations are online again
- 2026-10-21 18:27 - LimeSurvey installations are online again
- 2026-10-21 18:35 - all still maintained PHP-Versions (8.2 to 8.5) are updated + rolled out to our managed servers v8, v9 and v10
- 2026-10-21 22:00 - for v9 and v10: we are gradually bringing all web servers back online
- 2026-10-23 14:00 - We have updated the FAQ below. Please don't hesitate to contact us if you have any questions. For less urgent questions, it may take longer than usual to respond
External Sources:
Affected Versions
Patch status:
- Managed Server 10
- ✅ PHP 8.5
- ✅ PHP 8.4
- ✅ PHP 8.3
- ✅ PHP 8.2
- ✅ PHP 8.1 (EOL) => manually backported
- ✅ PHP 8.0 (EOL) => manually backported
- ✅ PHP 7.4 (EOL) => manually backported
- Managed Server 9
- ✅ PHP 8.5
- ✅ PHP 8.4
- ✅ PHP 8.3
- ✅ PHP 8.2
- ✅ PHP 8.1 (EOL) => manually backported
- ✅ PHP 8.0 (EOL) => manually backported
- ✅ PHP 7.4 (EOL) => manually backported
- Managed Server 8 (EOL)
- ✅ PHP 8.4
- ✅ PHP 8.3
- ✅ PHP 8.2
- ✅ PHP 8.1 (EOL) => manually backported
- ✅ PHP 8.0 (EOL) => manually backported
- ✅ PHP 7.4 (EOL) => manually backported
- ⚠️ PHP 7.2 (EOL)
- ⚠️ PHP 7.0 (EOL)
- ⚠️ PHP 5.6 (EOL)
- ⚠️ Managed Server 7 (EOL)
- ⚠️ Managed Server 6 (EOL)
- ⚠️ Managed Server 5 (EOL)
Legend:
- ✅ = PHP has been updated or manually backported
- ⚠️ = Hardening Measures
FAQ
How can I find out if my Managed Server or my PHP version has reached EOL?
A server's EOL date is visible in the Cockpit when it is created and also on the Managed Server Roadmap, as are the EOL dates for the PHP versions in use. In addition, the technical contacts are notified in advance via email about the upcoming EOL date.
Which PHP features are no longer working?
For updated or backported PHP versions, everything works as usual (see ✅ in the list above). For Managed Servers and PHP versions that we could not update (see ⚠️ in the list above), we have enforced the mitigation measures recommended by the NCSC at https://security-hub.ncsc.admin.ch/#/posts/13083 system-wide. There, we implemented the following hardening measures:
- We block multipart requests at the web server level (Apache or NGINX)
- We set
session.upload_progress.enabled to 0
Depending on how your specific CMS/PHP project works, this can cause uploads and forms/POST-requests to stop working. For security reasons, these measures can no longer be disabled. If these features are required, a migration to one of the two supported Managed Server versions, 9 or 10, is mandatory.
What does EOL mean?
Generally speaking, an End-of-Life product (EOL product) is a product at the end of the lifecycle which prevents users from receiving updates, indicating that the product is at the end of its useful life. Users can continue to access discontinued products, but cannot receive security updates and technical support.
See https://docs.opsone.ch/general/end_of_life.html
