On October 21, 2026, the PHP project published two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). They allow unauthenticated attackers to execute code remotely. Since i-doit runs on PHP, all i-doit installations are affected. The vulnerabilities are in PHP, not in i-doit. No i-doit update is required.
i-doit Cloud
No action is required. We update all i-doit and i-doit up cloud instances. The current status is shown on our status page: status.docupike.com
On-premises
Update PHP with the distribution's package manager, then restart PHP-FPM and the web server. Create a backup or snapshot first.
The knowledge base explains how to install and verify the update and what to do if an immediate update is not possible: PHP security update
Step-by-step guides:
Comments
0 comments
Please sign in to leave a comment.