Security updates must not only be available, they must also be installable quickly. The current PHP vulnerabilities have shown once again how important clear responsibilities and the right access rights are in an emergency.
The current BSI warning on PHP
The BSI warned of the vulnerabilities CVE-2026-109618 and CVE-2026-109619. They were rated critical with a CVSS score of 9.2 out of 10 under CVSS version 4.0. According to current knowledge, attackers can execute malicious code remotely on unpatched systems without logging in and without any user interaction.
The PHP project has released patches for several versions. PHP versions that are no longer supported do not receive regular security patches, so a version upgrade is part of the risk assessment. PHP2Shell also shows that known vulnerabilities and outdated runtimes should not be put off.
Our response
We reviewed all systems managed by FaNetwork and started installing the security updates. These include numerous servers in data centres that we operate on behalf of our clients.
We increasingly run new and existing client projects on a separate VPS per project. This allows responsibilities, access, patch levels and monitoring to be clearly separated and controlled for each project.
When access is missing
Clients with a different hosting provider have also asked us for help. Without administrative access, however, we cannot check their servers or install updates ourselves.
This is not a lack of willingness. Changes to running systems may only be made with clear approval and the right access. That keeps the work safe and traceable.
Not one provider, but clear responsibility
Not everything has to be with a single provider. What matters is that a responsible technical partner has full access to all relevant systems in an emergency and can apply updates immediately.
Centrally managed hosting with a separate VPS per client project creates clear responsibilities. It shortens coordination and enables a fast response to critical security warnings.
Not sure who updates your servers in an emergency? Talk to us. Together with you, we review access, responsibilities and patch levels.
Concrete next steps
Take inventory of PHP versions and exposed systems, check available patches and plan to replace unsupported versions. Restrict access, secure backups and test restoration. Also define who assesses security advisories, approves changes and documents the implementation.
Source: BSI warning on PHP vulnerabilities (German)
Facing a similar problem?
We analyse your starting point and show you a pragmatic next step.
Book an initial consultation