Skip to content

What happened

PHP is a programming language that many websites and web applications run on. Both vulnerabilities are rated critical, with a CVSS score of 9.2 out of 10. According to the German BSI, the two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow attackers to run malicious code remotely on web servers with PHP applications, without logging in and without any user interaction. The PHP developers released patches for several PHP versions on 21 October.

Lobster products are NOT affected

Our entire product suite (Lobster Data Platform, Platform Portal, Lobster Cloud, Trading Partner Manager, Lobster _data and Lobster _pro) is built on Java and does not use PHP. The same applies to everything we run in the Lobster Cloud. We don’t install PHP when we set up our products, and PHP has never been part of our product engineering.

No action is required to keep operating Lobster products.

What you should check

Other PHP-based applications in your company may be affected, for example WordPress running your website. This also applies if a PHP application runs on the same server as your Lobster installation, as some on-premises customers do for applications of their own. The vulnerability sits in PHP, not in Lobster software, but if that PHP installation isn’t updated, the server is at risk. That is one of the reasons we recommend running our products on a dedicated server without other applications.

If you use PHP-based applications, please contact your administrator or hosting provider and follow the official guidance from the vendor of each application. The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older won’t receive a fix, so servers running those versions should not be reachable from the internet until they have been upgraded.

More Information

You’ll find the full details in the BSI warning (in German).

If you have any questions, our support team is happy to help you.