PHP Security Updates of October 21, 2026
On October 21, 2026, PHP released fixes for two critical vulnerabilities. These flaws can let an attacker run code on a server without logging in. This guide explains what to do after a data breach in Germany and the EU.
PHP (software that runs many web applications) supports corporate websites and business systems. Affected services can include CRM (customer relationship management), ERP (business resource planning), billing systems and client portals. The guidance below is for mid-market B2B companies in Germany. It also covers US businesses whose data processing is subject to the GDPR.
The official PHP advisory describes code execution with web worker rights (the permissions of the process running the website). This does not automatically give an attacker root access (full control of the server). Databases, files and integration keys accessible to that process may be at risk.
A vulnerability does not prove that a breach occurred. The public disclosure date also differs from the discovery date. Each company needs to check its own systems.
How Webdelo Updated All Clients on Support
Our team installed the emergency PHP updates for all clients on support plans. Webdelo CTO Andrew Popov described the work on October 22, 2026:
"As soon as the PHP updates were released, we installed them urgently for all clients on our support plans. Our engineers worked in the office until late at night. Our clients were running different PHP versions, and we took that into account during the updates."
These emergency updates addressed the vulnerabilities. Checking whether a system had been accessed before patching is a separate task.
Short Technical Note for IT Teams
CERT-EU (the cybersecurity team for EU institutions) rated both vulnerabilities 9.2 out of 10 on CVSS (a severity scoring system). Its advisory identifies CVE-2026-109618 and CVE-2026-109619.
- First fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Older branches: PHP 8.1 and earlier need a supported branch or a fixed vendor package. Check vendor backports (fixes added to older packages) against both vulnerabilities.
- Affected setups: All PHP installations serving web requests may be affected. Exploitation depends on the build, extensions and configuration.
- Update verification: Patch PHP itself. Updating a CMS (website content management software) or plugin does not patch PHP. Check the running PHP version afterward.
- Temporary protection: A WAF (a filter for web requests) does not replace the update. CERT-EU advises considering isolation of the internet-facing application if patching cannot be completed and verified quickly.
First Incident Response Steps: Who Does What
Assign one person to coordinate the response. Record the detection time and known facts. Run technical recovery and the assessment of risks to people at the same time. Document decisions and actions throughout.
- Bring in the right people. Involve management, IT or your IT contractor, and your data protection officer or lawyer.
- Limit dangerous access. Isolate affected services where needed. Preserve logs and other evidence before destructive changes.
- Find the scope. Identify affected systems, personal data and people. Check whether unauthorized access is continuing.
- Assess notification duties. Evaluate the risk to people while technical work continues. Do not wait for repairs or the full investigation.
- Restore safely. Fix the cause and remove unauthorized access. Check the system before returning it to normal use.
Under the GDPR (EU rules on personal data), the authority notification clock starts when the company is reasonably certain that personal data was compromised. When notification is required, act without undue delay and, where feasible, within 72 hours. Missing details can follow in phases.
Affected people must be informed without undue delay when a high risk is likely, subject to legal exceptions. An IT contractor processing data for a client must inform that client without undue delay. The 72-hour period is not a repair deadline or a general deadline for informing people.
NIST (the US National Institute of Standards and Technology) incident response guidance connects preparation, response, recovery and improvement. It provides a practical framework. German and EU law determine the notification duties discussed here.
Avoid Losing Evidence in the First Hours
Do not wipe or reinstall affected systems before preserving evidence. Disconnecting a system from the network differs from powering it off. The joint US agency ransomware guide warns that powering off can destroy evidence held in memory.
A backup restores access to data. It cannot undo an attacker's earlier copy. A patch fixes a known weakness but does not prove that nobody entered before the update.
What Counts as a Personal Data Breach
A personal data breach is a security incident involving lost, destroyed, changed, improperly disclosed or unlawfully accessed personal data. Accidental disclosure can qualify. An attack is not required.
The EDPB (the board of EU data protection authorities) breach guide explains these categories. An initial assessment should check:
- Whether someone without permission accessed or received personal data.
- Whether personal data was changed without authorization.
- Whether personal data was lost, destroyed or made unavailable.
Ransomware (malicious software that blocks access to data) can cause a personal data breach even without proven copying. Loss of availability can harm people too.
B2B records often contain personal data. Named contacts and their work email addresses are examples. User accounts and salary records can also identify people.
Purely corporate information without personal data is not automatically covered by the GDPR. Contracts and other rules may protect it. A personal data breach does not automatically establish a GDPR violation or lead to a fine.
An Accidental School Email Disclosure
Andrew Popov shared a personal account involving a private school in Prague. A mailing exposed parents' email addresses to other recipients. The school then prepared incident messages and documents.
This account has not been independently verified with documents. An exposed address list requires assessment and documentation. Notification depends on the risk involved.
GDPR Data Breach Notification: Who to Tell and When
Document every personal data breach internally. Notify the authority without undue delay and, where feasible, within 72 hours of awareness, unless a risk to people is unlikely. Inform affected people without undue delay when a high risk is likely, subject to the legal exceptions.
| Recipient | Condition | Deadline | Main information |
|---|---|---|---|
| Internal breach records | Every personal data breach, under GDPR Article 33(5) | Document as the response proceeds | Facts, effects, risk assessment, decisions and corrective action |
| Data protection authority | Unless a risk to people's rights and freedoms is unlikely | Without undue delay and, where feasible, within 72 hours of awareness | Nature, scope, contact details, likely consequences and response measures |
| Affected people | A high risk is likely, subject to Article 34 exceptions | Without undue delay | Clear explanation, contact details, likely consequences and protective measures |
| B2B client | You process affected personal data on the client's behalf | Without undue delay after awareness | Known facts and information needed for the client's response |
The EDPB notification guidelines define awareness as reasonable certainty that an incident compromised personal data. The clock starts before the investigation is complete. The 72 hours are not a general waiting period.
Send available information first if details remain missing. Provide the rest in phases without undue further delay. A notification submitted after 72 hours must explain the delay.
The authority notification should include:
- The nature of the breach.
- Categories and approximate numbers of affected people and records, where possible.
- A data protection officer or other contact point.
- The likely consequences.
- Measures taken or planned to address the breach and reduce harm.
Exceptions to informing people include effective encryption that makes the affected data unreadable to unauthorized parties. This protection depends on the keys remaining secure. Assess the actual circumstances before relying on an exception.
Which German Authority to Contact
Most private companies report to the data protection authority of their federal state. The BfDI (Germany's Federal Commissioner for Data Protection) supervises federal bodies and certain sectors, including telecommunications and postal services.
Use the official directory of German state data protection authorities to find the relevant office. Cross-border processing requires a separate check of which authority is competent.
Germany's law implementing NIS2 (EU cybersecurity rules for specified organizations) took effect on December 6, 2025. Covered organizations must also report significant incidents to the BSI (Germany's federal cybersecurity office). Those duties do not replace GDPR notification.
When the Incident Happens at an IT Contractor
A processor (a provider handling personal data for a client) must inform the client without undue delay after awareness. It must not wait for its own full risk assessment. The controller (the organization deciding why and how data is used) remains responsible for notifying the authority.
Actual work determines these roles. Transferring support does not transfer all responsibility. A contractual deadline for informing the client cannot extend GDPR deadlines.
Agree on incident contacts and escalation before work begins. Define how the contractor will help with evidence and notifications. Our guide to protecting customer data when working with IT contractors covers related access and responsibility issues.
What a Breach Can Cost Your Business
A breach creates costs before any fine is considered. Work may stop while the company investigates and restores systems. Notifications and customer questions require staff time. Authorities may impose corrective measures, and affected people may seek compensation.
The GDPR legal text gives authorities several powers. These include:
- Warnings and reprimands.
- Orders to correct data processing.
- Restrictions on processing.
- Administrative fines.
An official audit does not automatically follow every incident. The circumstances and the company's response matter.
For duties such as security and breach notification, fines can reach €10 million or 2% of worldwide annual turnover from the preceding financial year. The higher ceiling applies. For other categories, including basic processing principles, the ceiling is €20 million or 4%, whichever is higher.
These are conditional maximums. They are not standard amounts for each breach. Compensation is separate and requires a violation, damage and a causal link.
A company's size or low public profile does not prevent automated scanning for vulnerable systems. Staff mistakes can also expose data.
Historical Case: A €65,500 Fine for an Outdated Shop
The Lower Saxony data protection authority's 2020 report, published on May 27, 2021, describes a €65,500 fine. The authority examined an online shop after a breach notification.
The shop used xt:Commerce 3.0.4 SP2.1. The software had been outdated since at least 2014 and lacked security updates. Password protection was also inadequate.
The company accepted the fine. Its warning to customers to change passwords was considered when setting the amount. This is a historical enforcement case, not a new 2026 fine.
Breach Notifications in Bavaria
BayLDA (the Bavarian data protection authority for the non-public sector) recorded 23% more breach notifications in 2025 than in 2024. The figures cover its supervisory area in Bavaria. They do not measure all German breaches or the number of affected people.
2023 2,753
2024 2,930
2025 3,603
Zero baseline. Bavaria, non-public sector under BayLDA supervision. Source: 15th Activity Report 2025, section 2.3, printed page 14.
The BayLDA report also records 3,946 notifications in 2021. Growth was therefore not continuous. These figures do not establish that AI caused the recent increase.
For broader enforcement context, the EDPB Annual Report 2025 lists the following German totals. They cover different data protection violations, not only breaches.
499 Fines reported for Germany in 2025
€48,117,083 Total fines reported for Germany in 2025
How AI Is Changing the Pace of Attacks
AI can speed up code analysis, vulnerability discovery and some attack steps. Faster analysis of published fixes can shorten the time available to update exposed systems. Human researchers and attackers still make important decisions.
OpenAI reports that Calif researchers used an AI model to find a critical PHP bug. Wiz independently found and reported both vulnerabilities. PHP maintainers led the fixes.
Google Cloud also describes AI-assisted research and fix verification. These accounts show specific uses of AI within work carried out by researchers and developers.
AWS observed an exploit attempt on October 17, 2026, before public disclosure. The observation came from MadPot, its decoy network. AWS does not know whether those early attempts would have succeeded against real systems.
After disclosure, AWS saw rapid use of public exploit demonstrations against its sensors. AWS assesses that AI reduces the effort needed to analyze patches. The observations do not establish that AI produced every attempt.
The NCSC (the UK cybersecurity agency) forecasts faster attacks at greater scale through 2027. It considers fully automated sophisticated attacks unlikely. Automated mass scanning existed before AI.
What Ongoing Technical Support Should Cover
Ongoing support should keep software versions known and updates current. It should control access and check whether backups can be restored. Regular server and code checks help identify risks. A written incident plan assigns responsibilities before an emergency.
| Work | Why it matters for the business |
|---|---|
| Inventory software versions and owners | Shows which services need action when a security notice appears. |
| Update PHP, the CMS, plugins, dependencies and server software | Closes known weaknesses across the system. |
| Review access rights | Limits unnecessary access and removes obsolete accounts. |
| Check code, settings and suspicious files | Helps identify insecure behavior and malicious code. |
| Maintain logs and alerts | Supports detection and investigation. |
| Keep backups and test restoration | Checks whether business services can be recovered. |
| Maintain an incident plan and contact list | Defines who coordinates technical work and notification decisions. |
Webdelo supports corporate and mid-market B2B clients in Germany and the United States. Our work covers corporate websites, CRM, ERP and other business services. Supported services can include:
- Regular technical checks of servers.
- Software and system updates.
- Code reviews.
- Checks for malicious code, including viruses and trojans.
Our guide to what website maintenance includes explains support scope and cost factors. Its price ranges are market examples, not a quote for your system.
Check frequencies, coverage hours and response targets depend on the contract. Our support and incident-response commitments describe plan-based targets. Agreed service terms do not extend legal notification deadlines.
Access management and development controls also affect customer data protection. You can review our data security practices when assessing these parts of a support arrangement.
Request a Security Audit from Webdelo
A website security audit helps assess the current state of your system and identify risks. It sets priorities for fixes and helps plan ongoing support. The scope can cover a website, CRM, ERP or another business service.
B2B companies entering Germany or the United States need technical readiness and localization. They also need prepared operating processes. Webdelo provides digital support for entering new markets, including these digital preparations.
To help define the audit scope, prepare:
- Your website address or a short system description.
- Known software versions.
- The current concern or task.
Do not send passwords or secret keys through an open form. After the audit, we can plan support with regular server checks, updates, code reviews and checks for malicious code. Scope and service terms depend on the contract.
Contact Webdelo for a security audit of your website, CRM, ERP or other business service. We will help identify risks, prioritize fixes and plan ongoing support.
Frequently Asked Questions
Is an exposed email address list a data breach?
It can be. Email addresses of named people are personal data. Accidental disclosure can count as a personal data breach without any attack. Document the incident and assess the risk to people, because notification depends on that risk.
What if the investigation is not finished within 72 hours?
Do not wait for the investigation to end. The 72 hours start when you are reasonably certain that personal data was compromised. If notification is required, send the facts you have and add missing details in phases. A notification sent after 72 hours must explain the delay.
Who notifies when the incident happens at an IT contractor?
A contractor processing data for you must inform you without undue delay. Your company usually decides how data is used, so it remains responsible for notifying the authority. A contract deadline cannot extend GDPR deadlines. Agree on contacts, escalation and help with evidence before work begins.
Are an update and a backup enough after a breach?
No. A backup restores access to data. It cannot undo a copy an attacker already made. An update closes a known weakness. It does not prove that nobody entered before it, so also check logs, access rights and files for malicious code.
Why does the GDPR apply to B2B companies too?
B2B records often contain personal data. Named contacts, work email addresses, user accounts and salary records identify people. Purely corporate information without personal data is not automatically covered by the GDPR. Contracts and other rules may protect it.
