PHP Security Warning: What It Means for Our Customers

Updated: 22 October 2026. This short message explains the current PHP security warning and what it means for your website.

Germany’s Federal Office for Information Security (BSI) warned of two critical PHP vulnerabilities on 21 October. PHP is technology used by many websites and online shops. Under certain conditions, attackers could exploit these vulnerabilities to run unauthorised code on a server. Security updates are available and should be installed immediately on affected systems. The warning does not mean that every website has already been attacked. ^{[1] [2]}

As a Lovable Partner, we develop websites and web apps with Lovable. Our usual application setup does not use PHP. Our own Maluure website also runs without PHP. For this setup, our assessment is that the current warning creates no direct need for a PHP update of your own. ^[8]

This assessment concerns the individual application, not a blanket security guarantee for the platform provider. An additional WordPress blog, a separately operated shop or another external service may use PHP independently and needs its own assessment.

As certified Webflow experts, we also look after websites on Webflow. With a website hosted normally on the platform, you do not maintain a PHP installation yourself. Webflow does not support server-side PHP in its custom code areas. We therefore see no direct need for a PHP update of your own for these websites because of the reported vulnerabilities. ^[7]

The same distinction applies here: external booking systems, shops and separately hosted applications are independent systems. Our assessment does not replace checks of those services and is not a comprehensive all-clear for every Webflow system.

We only rarely look after WordPress, TYPO3 and similar PHP systems. If you operate one, the warning still matters: Ask your hosting provider or responsible IT service provider immediately whether the security updates have been installed. Not every installation is automatically vulnerable, but unpatched PHP systems require urgent action. ^{[2] [5]}

WordPress explicitly explains that these vulnerabilities are in PHP, not WordPress itself. Matomo also calls for a PHP update for self-hosted installations. ^{[5] [6]}

You can send your host this short message: “Please check whether our website and other PHP applications are protected against CVE-2026-109618 and CVE-2026-109619, and confirm their update status.”

Not sure which system your website uses? Contact us. For more about ongoing care, see our article on website maintenance and responsibilities.