Published: 21 Oct 2026, 12:00 | Last updated: 21 Oct 2026, 12:09 | Next update no later than: 21 Oct 2026, 17:00
What happened
On 20 October 2026, the PHP project’s security team announced the release of critical security updates, scheduled for 21 October 2026 at 16:00 CEST. According to the official announcement, these address two critical vulnerabilities in the PHP interpreter with a CVSS severity of 9.2; according to published analyses by security firms (CVE-2026-109618 and CVE-2026-109619), they may allow remote code execution on the server. The vulnerabilities affect PHP itself, a technology used worldwide that powers a large share of web applications, including the Flowbox platform. This is not a bug in the Flowbox application.
What this means for Flowbox operations
Flowbox is treating the vulnerability as a highest-priority security incident and is following its security vulnerability management process.
Flowbox cloud installations with a web interface accessible from the public internet: as a precaution, we temporarily took the web interface and API offline on 21 October 2026 at 12:00. Data collection from meters and devices continues without interruption. We will restore the interface immediately after the security update has been deployed and verified. We have informed affected customers directly.
Installations running in the customer’s internal network: the vulnerability cannot be exploited from the internet here, so we are not taking these installations offline. We have informed affected customers separately. For installations whose servers are managed by Flowbox, we will deploy the PHP security update ourselves as soon as it is available for the server distribution in use. For customer-managed installations, we recommend applying the update as soon as possible; Flowbox will provide assistance.
Next steps
We will deploy the PHP security updates on all Flowbox-managed servers immediately after they are released for the server distributions in use. We cannot directly influence when the distributions make the patched packages available. We will update this page no later than 17:00 today, even if the status has not changed; we will inform affected customers directly when individual installations are back in operation.
Update history
- 21 Oct 2026, 12:00: precautionary shutdown of the web interface of cloud installations accessible from the public internet.
- 21 Oct 2026, 12:09: publication of this notice.
Sources
Official PHP project announcement: https://www.php.net/archive/2026.php#2026-10-20-1
Contact
Flowbox technical support: support@flowbox.com. Security findings can be reported to security@flowbox.com.