The Big PHP Incident – When the World Briefly Stood Still

Some of you will certainly have noticed what has been going on over the last few hours: many panicked website operators, uneasy providers of web services, and cautious hosting providers.

So what happened?

On 20.10.2026, CVE-2026-109618 and CVE-2026-109619 were disclosed: two highly critical security vulnerabilities in the programming language PHP, which our site is also built with. With the right background knowledge, it was possible to execute foreign code. The commotion was therefore entirely understandable.

Were we affected?

In principle, every site running on PHP was affected. But we enabled maintenance mode as early as possible, which meant no more code could be executed. Once the patch became available, it was applied to our systems immediately and everything was checked. The review showed that neither vulnerability was actively exploited. We can therefore give the all-clear.

Is my data safe?

As mentioned, neither vulnerability was actively exploited. The concept of this project is designed so that as little personal data as possible is openly accessible. Should the system ever be compromised, personal address data, for example, is encrypted with the password you chose. Even in the backend, it is not possible to view it without your consent.

Transparency

Transparency is especially important to us. You can inspect the source code at any time and reach us via the contact form. Feedback, criticism and suggestions are welcome at any time. We strive for the greatest possible protection of your data and for compliance with legal requirements, in some cases even going beyond them. We use no trackers or external providers whatsoever and only create internal statistics for evaluation, which are not based on any personal data and are completely anonymous.

We wish you a pleasant stay on this site.