Dear ILIAS Admins,
we would like to inform you about a recent PHP Announcement about two critical PHP security issues whose fixes will be published today (Oct 21st) at 2pm UTC: https://www.php.net/archive/2026.php#2026-10-20-1
We, as the ILIAS Technical Board, are not aware if and how this issue could be exploited in a running ILIAS installation but we want to inform you about this issue due to its severity. There are many ILIAS installations that were already either put behind a firewall or completely set offline. We ask you to at least check the three weblinks we provide in this e-mail and then decide on how to proceed for your ILIAS installation. The final decision will need to be done by your institution.
We are closely monitoring all new information via e.g. https://www.cms-admins.de/news/php2shell-kritische-php-sicherheitsluecken-cv... and https://www.heise.de/news/Wichtige-PHP-Updates-am-21-Oktober-beheben-Codeein....
Heise announced that they will publish further findings at 4pm when the official release of the fixes takes place.
Let's keep the fingers crossed for all PHP applications worldwide.
Best regards, Rob
For the Technical Board of the ILIAS Society