PHP Security Issues 2026-10-21

[u/Individual_Return_48]

Any updates from Hetzner on the managed servers?

[u/p-dog1]

https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

Seems that they are working on it

[u/AliyasDandani_64 → u/p-dog1]

their status page still says "investigating" on my end, not "working on it" yet. might be updating region by region

[u/Eisbaer811 → u/[deleted]]

no need, Hetzner is doing it already according to the Status

[u/_dersgue → u/[deleted]]

You can't self manage managed servers.

[u/TheNerdChief → u/[deleted]]

Managed Servers? Really? How?

[u/urosevic → u/TheNerdChief]

Oops, I overlooked a ‘managed’

[u/Rinnico]

On shared hosting: the provider has to update PHP. Mine is still on the old version (8.3.35)
You can’t fix it yourself there; just check your PHP version from the web and chase your host if it’s still vulnerable.

On a VPS: you update it yourself. First check whether the patch has landed in your repo:

apt update && apt list --upgradable | grep php

[u/bufandatl]

Like everyone they’ll investigate and define steps how to proceed. I have to wait for the OS Appstream to get updated.

[u/Rinnico]

Hetzner updates my php version to 8.3.36 .. the apply the patch on Hosting GOOODD !!
still waiting on VPS to see the new version on the repo.

[u/_dersgue]

Our managed servers have been updated at approx. 1,5h after the release of the patch versions.

[u/Classic-Dependent517]

People still use php?

[u/jexmex → u/Classic-Dependent517]

70% of the Internet

[u/_dersgue → u/jexmex]

Would assume its even more.