What Hetzner says
Hetzner status incident 'PHP security issues CVE-2026-109618 and CVE-2026-109619' (opened 21 Oct 2026 11:04 UTC; the label still reads 'Investigating'). PHP's recommended mitigations were applied before the fix. Patched builds of PHP 7.4 and 8.0–8.5 were deployed on all Webhosting and Managed Servers by 17:50 UTC on 21 Oct, and the remaining 5.6 and 7.3 by 04:32 UTC on 22 Oct. The rollout also covered konsoleH, Storage Share (Nextcloud), phpMyAdmin and Webmail. Dedicated and cloud server customers are contacted by email and must update their own PHP.
We deployed patches for the remaining PHP versions 5.6 and 7.3 on all Webhosting- and Managed-Servers.We deployed patches for the PHP versions 7.4 and 8.0-8.5 on all Webhosting- and Managed-Servers.carefully monitor your systems for suspicious activity and possible signs of an attack.PHP security issues CVE-2026-109618 and CVE-2026-109619What you need to do
Web hosting (konsoleH) and Managed Server: Hetzner has patched every PHP version it runs, so there is nothing to install. Remove any per-directory .htaccess FcgidWrapper pinning to old PHP, and move off end-of-life versions when you can. Dedicated Root Server and Cloud Server customers must update PHP/OS packages themselves.
Check which PHP your site runs
konsoleH > select hosting > Einstellungen > PHP-Konfiguration (CLI: /usr/bin/php uses the konsoleH-set version)
In WordPress, Tools › Site Health › Info › Server shows the PHP version. Paste it into the version check to see whether it is fixed.
Switch to a supported version
konsoleH > Einstellungen > PHP-Konfiguration > choose version > Speichern; per-directory override via .htaccess FcgidWrapper
Versions offered: 5.6, 7.3, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5.
If you can, choose PHP 8.4. It is fixed, supported until 31 December 2028 and runs almost all current plugins. See which version to choose.
Old PHP versions
We found no paid support for old PHP versions at Hetzner.
Ask Hetzner directly
Copy this into a support ticket and fill in the parts in square brackets.
Hello Hetzner support,
PHP released fixes for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
My account: [account or contract number]
My site: [domain]
PHP version shown in my control panel: [version]
Please confirm:
1. Whether the PHP that serves my site has been updated to one of the fixed releases, or to a build with the fix backported, and the exact version.
2. Whether the PHP processes for my site have been restarted since the update.
3. If not yet, when you expect to finish.
4. If my version is 8.1 or older, which supported version you recommend I switch to.
Thank you.