PHP2shell and Kernel Vulnerability CVE-2026-98432

Originally, the disclosure of vulnerabilities and the corresponding patches in the PHP programming language - which is estimated to be used in approximately 80% of the known Internet - was announced and scheduled for October 22^nd, 2026.

The advance notice had already hinted at the severity of the vulnerabilities. Due to a leak, the disclosure was subsequently moved up by one day to October 21^st, 2026.

We began implementing security measures on our server systems that very morning, after some details became known. This also led to minor functional disruptions on customer systems, and we communicated this transparently. For security reasons, we completely took some internal systems - or those that only slightly restricted a small group of customers - offline.

The patches were finally deployed on all of our publicly accessible server systems by 4:10 p.m. CEST. The functional restrictions mentioned at the beginning were thus lifted; however, we did not reconnect some internal systems to the network. It was not until last week that the final systems were patched and released back into the “wild.”

Over the past week, another vulnerability in the Linux kernel was disclosed. This vulnerability allowed malicious code to be executed on server systems via the network stack. On November 1^st and 2^nd, we patched this vulnerability on all systems by installing the relevant patches and restarting the systems.

The vulnerability is classified as critical and has been assigned the designation CVE-2026-98432.

A working exploit is not currently known to the public but is accessible only to a limited group of experts. Furthermore, this exploit requires a setting in the Linux kernel’s network stack that is NOT enabled by default on our systems.

The frequency of updates addressing critical security vulnerabilities is likely to continue to increase in the coming months, or at least remain at the current high level. The reason for this is that artificial intelligence has now become a widely adopted tool in software companies around the world, significantly accelerating the search for vulnerabilities and errors in extensive program code.

We explicitly do not wish to join in the sensationalism of some media outlets. Like any other tool, this is exactly that: a tool that simplifies and speeds up the daily work of experienced professionals, much like the steam engine more than 200 years ago or the Internet more than 30 years ago.

Therefore, the simple maxims still apply:

• A fool with a tool is still a fool.
• If my only tool is a hammer, every problem looks like a nail.