Dear Blue Knights,
this notice is meant for everyone who looks after a chapter website. If that is not you, please simply forward this mail to your chapter’s webmaster. Thank you!
On 21 October 2026 the PHP project released fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). They can allow attackers to run code on a web server without logging in, and active exploitation has already been reported. This affects almost every chapter website running Joomla, WordPress or any other PHP-based system.
Why this matters for us in particular
In the current security situation in Europe, websites with a police or government connection are attractive targets for hybrid attacks. These come from hacktivist groups and state-linked actors who use compromised sites for defacement, disinformation or as a stepping stone to steal data. A Blue Knights website, with its clear link to law enforcement, fits this profile, even if it is “just” a club site. A vulnerability like this one is exactly the kind of opening such attackers look for. Please take this update seriously and do not postpone it.
What to do
If your website is on shared hosting (e.g. IONOS, Strato, OVH, one.com):
- Check in your hosting control panel which PHP version your site uses.
- Ask your provider whether the security update has already been applied. Most providers handle this themselves, but please make sure.
If you run your own server (VPS / dedicated):
- Make a backup or snapshot first.
- Update PHP via your package manager or control panel (Plesk and cPanel updates are already available).
- Restart PHP-FPM / Apache, otherwise the old code keeps running.
- Check the active version with php -v and a phpinfo page.
Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35.
PHP 8.1 and older no longer receive updates. If your site still runs on one of these, now is the time to upgrade.
Good habits in general: Keep your CMS, extensions and templates up to date, remove old plugins you no longer use, and watch for warning signs such as unknown files in your web folders or unexpected changes to your pages.
Official details: https://www.php.net/
If you are unsure about anything or need help, just reply to this mail.
Ride with Pride,
Karlo
European Webmaster
on behalf of the European Board
