Announcements
On October 21, 2026, two critical security vulnerabilities were disclosed in PHP (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities may allow attackers to execute malicious code on affected servers.
Admidio itself is not affected by these vulnerabilities. However, since Admidio runs on PHP, the PHP installation on your web server may be vulnerable.
We strongly recommend that all Admidio administrators check their PHP version and ensure that their hosting environment has been updated.
How to check your PHP version in Admidio
You can easily find the PHP version used by your Admidio installation:
- Log in to Admidio as an administrator.
- Navigate to Settings → Information → PHP.
- Check the PHP version displayed on this page.
Which PHP versions are secure?
The following PHP versions include the security fixes for both vulnerabilities:
| PHP Branch | Patched Version |
|---|---|
| PHP 8.5 | 8.5.12 or newer |
| PHP 8.4 | 8.4.27 or newer |
| PHP 8.3 | 8.3.36 or newer |
| PHP 8.2 | 8.2.35 or newer |
Older PHP versions, including PHP 8.1 and earlier, are no longer officially supported and should be replaced with a supported version.
Note: Some hosting providers may provide security fixes through backported patches without changing the displayed PHP version.
What should you do?
If your server is running an affected PHP version, please contact your hosting provider or update PHP through your hosting control panel as soon as possible.
Updating Admidio alone will not resolve these vulnerabilities, as they are located in PHP itself, not in the Admidio application.
For further information, please refer to the official PHP security advisory.
The Admidio Team