PHP forms the technical foundation of numerous websites and web applications. If critical vulnerabilities are discovered, web applications that use PHP may be affected. Today, October 21, 2026, two security vulnerabilities were identified—the security update was released at 4:00 p.m. German time and has already been deployed on all affected AEB websites. AEB’s cloud-based solutions are not based on PHP and were therefore not affected.
Assessment of the Security Vulnerabilities
This morning, the German Federal Office for Information Security (BSI) issued a warning about critical vulnerabilities in PHP, specifically the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. According to the BSI’s assessment, these vulnerabilities could allow attackers to remotely execute malicious code on web servers running PHP applications. The BSI therefore classified the criticality as “Orange”: measures must be taken immediately.
The good news for AEB customers: Everything has been patched
AEB has already implemented the security updates recommended by the BSI and has not detected any anomalies. The rapid deployment of security patches is also in line with AEB’s documented vulnerability management policy, which can be found in the Trust Center: Security at AEB.
If you also operate PHP-based websites or applications, you should check your patch status.