Description
We're aware of upcoming critical PHP security updates to be released today (2026-10-21).
As soon as the releases are out, we'll immediately start updating affected systems during the day.
We'll update this issue as needed.
Timeline
- 2026-10-20 21:00 - we started investigating
- 2026-10-21 11:00 - initial publication of this incident + waiting for official PHP information/releases
- 2026-10-21 13:00 - we're still waiting for the release PHP versions containing the hotfixes
- 2026-10-21 13:40 - for customers that want to reduce risks before the roll-out of new versions, we offer to stop web servers on managed servers for the time until the PHP updates are applied (upon request, please contact us)
- 2026-10-21 13:44 - we decided to temporarily shut down certain managed applications (Nextcloud, Matomo, LimeSurvey) as a precaution until the updated PHP versions are rolled-out
- 2026-10-21 15:50 - PHP has published updates. We are currently building and rolling out the packages
- 2026-10-21 16:44 - Nextcloud installations are online again
- 2026-10-21 18:25 - Matomo installations are online again
- 2026-10-21 18:27 - LimeSurvey installations are online again
- 2026-10-21 18:35 - all still maintained PHP-Versions (8.2 to 8.5) are updated + rolled out to our managed servers v8, v9 and v10
- 2026-10-21 22:00 - for v9 and v10: we are gradually bringing all web servers back online
External Sources:
Affected Versions
Patch status:
- Managed Server 10
- ✅ PHP 8.5
- ✅ PHP 8.4
- ✅ PHP 8.3
- ✅ PHP 8.2
- ✅ PHP 8.1 (EOL) => backported
- ✅ PHP 8.0 (EOL) => backported
- ✅ PHP 7.4 (EOL) => backported
- Managed Server 9
- ✅ PHP 8.5
- ✅ PHP 8.4
- ✅ PHP 8.3
- ✅ PHP 8.2
- ✅ PHP 8.1 (EOL) => backported
- ✅ PHP 8.0 (EOL) => backported
- ✅ PHP 7.4 (EOL) => backported
- Managed Server 8 (EOL)
- ✅ PHP 8.4
- ✅ PHP 8.3
- ✅ PHP 8.2
- ✅ PHP 8.1 (EOL) => backported
- ✅ PHP 8.0 (EOL) => backported
- ✅ PHP 7.4 (EOL) => backported
- ⚠️ PHP 7.2 (EOL)
- ⚠️ PHP 7.0 (EOL)
- ⚠️ PHP 5.6 (EOL)
- ⚠️ Managed Server 7 (EOL)
- ⚠️ Managed Server 6 (EOL)
- ❌ Managed Server 5 (EOL)
Legend:
- ❌ = Nothing has been done yet, or it isn't finished yet
- ✅ = PHP has been updated or manually patched
- ⚠️ = PHP will not be updated or patched. We have blocked multipart requests and set
session.upload_progress.enabled to 0. An update to a new server or PHP version is still recommended
FAQ
How can I find out if my Managed Server or my PHP version has reached EOL?
A server's EOL date is visible in the Cockpit when it is created and also on the Managed Server Roadmap, as are the EOL dates for the PHP versions in use. In addition, the technical contacts are notified in advance via email about the upcoming EOL date.
Why are uploads are no longer working in my application?
For Managed Servers and PHP versions that we could not update, we have system-wide enforced the mitigation measures recommended by the NCSC at https://security-hub.ncsc.admin.ch/#/posts/13083. For security reasons, these measures can no longer be disabled. If this functionality is required, an update to one of the two supported Managed Server versions, 9 or 10, is mandatory.
What does EOL mean?
Generally speaking, an End-of-Life product (EOL product) is a product at the end of the lifecycle which prevents users from receiving updates, indicating that the product is at the end of its useful life. Users can continue to access discontinued products, but cannot receive security updates and technical support.
See https://docs.opsone.ch/general/end_of_life.html
