On 21 October 2026, Germany's Federal Office for Information Security (BSI) issued a security notice on two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, also known as "PHP2Shell". Both are rated 9.2 out of 10 under CVSS 4.0: attackers can run code on web servers remotely, without authentication and without any user interaction. The BSI rates the situation "orange", the third of four levels, meaning action must be taken without delay. Matomo is a PHP application. If you run Matomo yourself, update PHP now.
What the BSI and PHP report#
- All PHP versions back to at least PHP 5 are affected, according to the BSI, citing CERT-EU. PHP itself names every installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
- The updates are out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October, fix both vulnerabilities. Linux distributions received the patches in advance and ship their own packages. According to PHP, there is no complete mitigation short of updating.
- Older versions: PHP 8.1 and older no longer get updates from the PHP project, though some distributions backport the fixes. PHP 8.2 receives security fixes only until 31 December 2026.
- Fast attacks expected: when it issued the warning, the BSI knew of no attacks yet, but of unconfirmed reports of exploits. It considers broad exploitation within a few hours of the patches likely, not least because AI-assisted tools analyse patches quickly.
Why self-hosted Matomo is a special case#
Many web applications can hide behind a VPN or an IP allowlist, and the BSI recommends keeping access to web applications as restrictive as possible. With Matomo, that only works for the interface. The tracking endpoint matomo.php has to be reachable for every visitor of every tracked website, without a login and from anywhere on the internet, or no tracking arrives. Requests without a login are exactly what these vulnerabilities exploit, and they reach the same PHP as the interface.
Then there is what sits on a Matomo server: the raw data of every visit, the database credentials in config.ini.php, API tokens and the tracking code, meaning matomo.js and the Tag Manager containers that every tracked website loads. Whoever takes over the server can change that code and serve malicious code on all of those websites.
What to do now#
- Check the right version:
php -von the command line can show a different version from the one PHP-FPM or Apache runs. In Matomo, you find it under Administration › Diagnostic › System Check. Distributions often patch by backport, so their security notice counts, not the version number. - Update: through your package manager, your hosting panel or freshly built container images.
- Restart the services: PHP-FPM and Apache keep running the old version until they restart. Afterwards, also check the PHP that runs your archiving cron job.
- Can't update right away? The workarounds in the PHP advisory are no substitute for the update. The BSI then suggests considering taking the server off the internet until it is patched. For Matomo, that costs the tracking data of that time, which is still better than a compromised server.
- Look for traces: under System Check › File integrity, Matomo reports unexpected files. Also check your superusers, new API tokens, cron jobs and new PHP files in the web directory.
- Retire old PHP versions: PHP 8.1 and older get no more updates, PHP 8.2 only until the end of the year. Before you switch, check that Matomo and your plugins run on the new version. Matomo 6 needs at least PHP 8.1, but pick a version that still gets security fixes, so PHP 8.3 or newer, see our Matomo 6 upgrade checklist.
Our sister brand sonora has a more detailed guide for Matomo servers (in German): PHP2Shell: Matomo-Server jetzt aktualisieren.
How we handle it for our customers#
For the Matomo instances we host ourselves, this is simply part of our job: we apply security updates for PHP, Matomo and the server without you having to do anything. How fast depends on the severity, and critical vulnerabilities like these we fix right away. For servers we look after under an SLA, the agreed deadlines apply.
