PHP has released security updates for CVE-2026-109618 and CVE-2026-109619. We’re rolling them out to konsoleH, Managed Server, Storage Share (Nextcloud), phpMyAdmin and Webmail. Finishing on all systems may take some time.
If you operate PHP on your own systems, then please install the updates as soon as possible and then check your systems carefully for suspicious activity or possible signs of an attack.
Current status updates are available on our status page here: https://status.hetzner.com/de/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

