Information on Handling the PHP Security Vulnerability

Friday, October 23, 2026

On Wednesday, October 21, it became known that the software PHP, which is also used in sciebo, has a serious security vulnerability. It was said to allow commands to be executed on the servers remotely without authentication. This is the worst security vulnerabilities we as admins can imagine. In the following, we briefly outline the measures we took.

10:00 In the morning, it became known that the vulnerability exists and that a patch would be made available at 16:00: https://www.heise.de/news/Wichtige-PHP-Updates-am-21-Oktober-beheben-Codeeinschleusung-Schwachstellen-11495072.html The problem for all admins is that with the release of the patch, hackers will simultaneously begin to analyze the vulnerability using AI in order to develop attacks. Pessimistic estimates assume just 15 minutes between the release of the information and the first attacks.
14:00 Internally and externally, we discussed whether to take the service offline proactively and only bring it back online once the vulnerability has been patched.
15:10 The web presence of the University of Münster (which also hosts sciebo) was completely disconnected from the internet to gain time to identify the vulnerable services and secure them separately. However, this also meant that our usual communication channels, such as https://docs.sciebo.de/docs/stoerungen/, were unavailable.
16:00 The details of the security vulnerability were published (precisely CVE-2026-109618 + CVE-2026-109619 also known ad PHP2Shell): https://www.heise.de/news/php2shell-Kritische-Sicherheitsluecken-erlauben-Codeeinschleusung-in-PHP-11492938.html The rush for the patched software was so great that it would take hours before it could be downloaded.
17:30 The status pages of the sciebo instances were reachable again.
22:00 After the patched versions of the vulnerable software had been installed, sciebo went back online.
October 22, 10:00 The website www.sciebo.de was also reachable again.

Further details: https://www.heise.de/news/php2shell-Updates-trudeln-ein-viele-Webseiten-offline-Angriffe-laufen-11496366.html