Resolved: all affected services have been running stably for over an hour on the patched PHP versions – the Deploy project on PHP 8.5.12, the mail server on PHP 8.2.35 and the Looking Glass on PHP 8.4.27. Webmail and the mail administration are reachable again. Thank you for your patience.

All affected services are patched: the paused PHP project on CitexNode Deploy has been rebuilt with the patched FrankenPHP runtime (PHP 8.5.12), the version in the running container verified and the website brought back online. The mail server has been running PHP 8.2.35 since the previous update, the Looking Glass PHP 8.4.27. We will keep monitoring the services for a while.

Mail server patched: the security update with PHP 8.2.35 has been rolled out and verified. Webmail and the mail administration are reachable again; sending and receiving email works normally. Only the paused PHP project on CitexNode Deploy remains: we are still waiting for the FrankenPHP runtime with PHP 8.5.12 and will bring it back once it is available and rolled out.

The new FrankenPHP version is taking a little longer: the PHP patch changes how memory limit overruns are handled, and the FrankenPHP developers are currently adapting their automated tests to it. Once that is done, the release with the new container images follows. We will rebuild the affected project right after that, verify the PHP version and bring it back online. Webmail and the mail administration remain locked until the mail server update; sending and receiving email works normally.

For context: details from the PHP security team are now known. CVE-2026-109618 can be exploited without authentication before the actual application starts; PHP-FPM and FrankenPHP are affected as well, and early attacks have been reported. The widely recommended configuration switch (session.upload_progress) only protects against the second vulnerability, not this one. That is why we took the affected services offline instead of keeping them running with a workaround, and we will only bring them back once the patched PHP version is verifiably running. We will post update progress here.

The official PHP images with the patched versions are now fully available. FrankenPHP (for the paused Deploy project) has not published its new version yet. A pre-built update for our mail server already exists, but our check showed that it still contains the old, vulnerable PHP version – so we are not rolling it out and are waiting for a corrected build. For every new image we verify the PHP version it actually contains before bringing anything back online. Webmail and the mail administration remain locked until then; sending and receiving email works normally.

The official PHP images with the patched version 8.5.12 are being published right now. Next, FrankenPHP builds its new runtime on top of them; this may take a little longer due to the current GitHub disruption. As soon as it is available, we will rebuild the affected project, verify the PHP version and bring it back online. Webmail and the mail administration remain locked until the mail server update; sending and receiving email works normally.

FrankenPHP is currently building its standalone binaries with the patched PHP version. For CitexNode Deploy we need FrankenPHP's container image; it follows as soon as the official PHP images are published, which are being built right now. We will roll out the update right after that. Until then the affected website stays in maintenance mode; webmail and the mail administration remain locked, while sending and receiving email works normally.

The patched official PHP images (8.5.12, 8.4.27, 8.3.36, 8.2.35) have been finally approved and are being built now. Once they are published, FrankenPHP and our mail server will follow; we will roll out the updates right away and post here. Until then the affected website shows a security maintenance notice; webmail and the mail administration remain locked, while sending and receiving email works normally.

The patched official PHP images have now been approved by the Docker maintainers. Next they will be merged and built – this usually takes 30–60 minutes, possibly a little longer due to the current GitHub disruption. FrankenPHP and our mail server follow after that; we will roll out both updates right away. Until then the affected website shows a security maintenance notice; webmail and the mail administration remain locked, while sending and receiving email works normally.

The automated checks for the patched official PHP images are almost complete and have all passed so far; only the approval by the Docker maintainers is still pending. After that, building the images usually takes another 30–60 minutes, followed by FrankenPHP and our mail server. We will roll out the updates as soon as they are available. Until then the Deploy project stays paused and webmail and the mail administration remain locked; sending and receiving email works normally.

Last step before the new images is underway: publishing the patched official PHP container images (8.5.12, 8.4.27, 8.3.36, 8.2.35) has been submitted and is waiting for final approval. The images will be built after that; FrankenPHP (for the paused Deploy project) and our mail server vendor have prepared their updates and will publish them right afterwards. We will roll out both updates as soon as they are available. Until then the Deploy project stays paused and webmail and the mail administration remain locked; sending and receiving email works normally.

Next step done: the Docker maintainers have approved the patched PHP versions (8.5.12, 8.4.27, 8.3.36, 8.2.35). The official container images are now being published and built; FrankenPHP with PHP 8.5.12 follows after that. This usually still takes some time. As soon as the images are available, we will rebuild the paused Deploy project, verify the PHP version and bring it back online. Webmail and the mail administration stay locked until the mail server update; sending and receiving email works normally.

Progress update: the update of the official PHP container images to the patched versions (8.5.12, 8.4.27, 8.2.35) has been submitted but is still waiting for approval by the Docker maintainers. Only then will the images be built, after which FrankenPHP publishes its runtime with PHP 8.5.12. We are continuously checking for the new images and will roll out the update right away. The affected Deploy project stays paused until then; webmail and the mail administration remain locked, while sending and receiving email works normally.

Our mail system uses PHP as well: webmail and the mail administration are therefore temporarily locked. Sending and receiving email (SMTP/IMAP) keeps working normally. Here we are waiting for the mail server vendor's update with PHP 8.2.35. This notice stays open until both the Deploy project and the mail system are patched – whichever update arrives first, we bring the parts back one by one.

Our Looking Glass (lg.citexnode.com) has been updated to the patched PHP 8.4.27 and is reachable again. For the paused PHP project on CitexNode Deploy we are still waiting for the FrankenPHP runtime with PHP 8.5.12; as soon as it is published, we will rebuild the project and bring it back online.

PHP has released the patched version 8.5.12. We cannot roll it out yet, though: PHP projects on our platform run on FrankenPHP, and its runtime with PHP 8.5.12 has not been published yet. As soon as it is available, we will rebuild the affected project, verify the PHP version and bring it back online. Until then it stays paused as a precaution; its data and files are not affected.

The PHP developers have released the fixes (PHP 8.5.12, 8.4.27 and 8.2.35). Our build environment uses the official container images, which are being built from them right now. As soon as the patched version is available, we will rebuild the affected project, verify the PHP version and bring it back online.

One PHP project on CitexNode Deploy is affected. We have paused it as a precaution; until the update it shows the "Project paused" page, and its data and volumes are unchanged. The PHP developers release the fixes today by 16:00 CEST. We will then rebuild the project with the patched PHP version and bring it back online.

Critical PHP vulnerabilities were disclosed today (CVE-2026-109618, CVE-2026-109619) that let attackers run code on the server. Public exploits exist. We are checking which customer sites on CitexNode Deploy use PHP. Other projects (Node.js, Python, static sites) are not affected.