PHP security vulnerabilities: Assessment and update preparations

Update timeline

1. investigating Oct 21, 2026, 12:11 PM UTC

   The vulnerabilities have been reported as potentially allowing **unauthenticated remote code execution**—meaning an attacker could execute code on an affected server without first logging in. Further information is available in the [CERT-EU security advisory](https://cert.europa.eu/publications/security-advisories/2026-018). The [PHP security team](https://www.php.net/archive/2026.php#2026-10-20-1) has scheduled a security release for **21 October 2026 at 14:00 UTC**, with affected versions and technical details to be published alongside the updates. **Customers running PHP on their own VPS or dedicated server should prepare to update their installations.** For self-managed services, software updates within the server remain the responsibility of the customer or their system administrator. We recommend the following steps: - **Identify your PHP installations**, including versions used by individual websites, hosting control panels and containers. - **Install security updates as soon as they become available** from your operating system, package repository or control-panel vendor. Check the vendor’s advisory to confirm that the installed package addresses these CVEs. - **Restart the affected services or redeploy updated containers as required**, and verify that your websites are using the patched PHP runtime. - **If a fix is unavailable or cannot be applied promptly, consider temporarily restricting public access** to affected PHP applications until they can be secured. Updating a CMS or its plugins alone does not replace updating the underlying PHP runtime. Official resources for administrators: - [PHP installation and platform-specific guidance](https://www.php.net/manual/en/install.php) - [PHP supported versions and security-support lifecycle](https://www.php.net/supported-versions.php) - [Ubuntu Security Notices](https://ubuntu.com/security/notices) - [Debian security advisories and update information](https://www.debian.org/security/) The security and stability of our services remain our highest priority. Further updates will be published here.

2. investigating Oct 21, 2026, 12:33 PM UTC

   **🚨 Emergency security measure** As a precaution against the critical PHP vulnerabilities, we are temporarily shutting down the following services: - **Order API** - **Management API** - **Control Panel** We are awaiting the announced PHP security patches. Access will be restored once the necessary updates have been applied and verified. We will keep you informed through this status notice.

3. resolved Oct 21, 2026, 03:41 PM UTC

   ✅ **All services restored** We have completed the required PHP security updates on all affected EDIS Global platform systems. Our **Control Panel, Order API and Management API** are back online, and all services are operating normally. Thank you for your patience during this precautionary shutdown. [View the status notice](https://status.edis.global/notices/u2tohtj9a3wg9mir-php-security-vulnerabilities-assessment-and-update-preparations)