Dear ILIAS Admins,
we would like to give you a quick update on the PHP Announcements: The advisories and the patches are now officially published: https://www.php.net/archive/2026.php#2026-10-21-5. Please make sure to update your PHP-versions as soon as possible to the latest release which should be available soon from the package registries. The PHP Foundation stated that "Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages."
Best regards, Rob
For the Technical Board of the ILIAS Society
Am 21.10.26 um 12:43 schrieb Rob Falkenstein:
Dear ILIAS Admins,
we would like to inform you about a recent PHP Announcement about two critical PHP security issues whose fixes will be published today (Oct 21st) at 2pm UTC: https://www.php.net/archive/2026.php#2026-10-20-1
We, as the ILIAS Technical Board, are not aware if and how this issue could be exploited in a running ILIAS installation but we want to inform you about this issue due to its severity. There are many ILIAS installations that were already either put behind a firewall or completely set offline. We ask you to at least check the three weblinks we provide in this e-mail and then decide on how to proceed for your ILIAS installation. The final decision will need to be done by your institution.
We are closely monitoring all new information via e.g. https://www.cms-admins.de/news/php2shell-kritische-php-sicherheitsluecken-cv... and https://www.heise.de/news/Wichtige-PHP-Updates-am-21-Oktober-beheben-Codeein....
Heise announced that they will publish further findings at 4pm when the official release of the fixes takes place.
Let's keep the fingers crossed for all PHP applications worldwide.
Best regards, Rob
For the Technical Board of the ILIAS Society
ilias-admins mailing list -- ilias-admins@lists.ilias.de To unsubscribe send an email to ilias-admins-leave@lists.ilias.de