Over the past few days, critical security vulnerabilities in PHP have been discovered. We want to inform you transparently about what this means for SIDES and your business. Many companies have temporarily taken their websites offline as a precaution.
What is this about?
On October 20, 2026, two serious vulnerabilities in PHP were discovered (CVE-2026-109618 and CVE-2026-109619). Under certain circumstances, attackers could have executed malicious code on affected web servers. The PHP project released security updates on October 21, 2026.
Were SIDES systems affected?
Parts of our platform are based on PHP. According to official security guidelines, our operational approach does not fall into the highest-risk configuration category; an attack would have required additional prerequisites. Nevertheless, we treated the situation with the highest priority from the very beginning.
What have we done?
Before official updates were available, we implemented protective measures on our servers that block the known attack vectors. Additionally, our systems are protected by a Web Application Firewall, which has been blocking corresponding attacks since the early morning of October 21, 2026. Immediately after the updates were released, we updated all affected systems and thoroughly reviewed them. None of our systems are still vulnerable to these vulnerabilities.
What do you need to do?
For using SIDES – cash register, webshop, ordering and delivery functions – you don't need to do anything. Your business runs as usual.
One note on our behalf: If you operate your own website alongside SIDES, such as with WordPress, it is very likely also running on PHP. In that case, please ask your hosting provider or web agency to roll out the security update promptly.
What happens next?
We continue to monitor developments closely and will take further measures immediately if needed. If you have any questions, you can reach our support team at any time.