On 21 October 2026, two critical security vulnerabilities in the PHP programming language were disclosed. As we have already received initial enquiries from customers regarding the security of SaaS.de, we would like to briefly explain which systems are affected and what measures we have taken.
Why SaaS.de is not directly affected
Our SaaS.de applications are based on Java and Kotlin and do not use PHP as a runtime environment.
The two disclosed PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) therefore do not affect the SaaS.de applications themselves – such as SaaS.de HR with time and attendance tracking, holiday management and other functions, nor do they affect SaaS.de Rooms & Halls.
There is no need for our SaaS.de customers to take any action as a result of these two PHP security vulnerabilities.
Our websites have already been updated
The situation is different for our information pages:
-
www.saas.de – our product and company website
-
hilfe.saas.de – our help and documentation portal
Both websites are powered by our content management system, EGOCMS, which uses PHP.
We responded immediately: as early as 21 October 2026 at 16:31, an updated Docker image – EGOCMS V26.3.4.2 – containing the PHP security updates was available. Our own websites were updated that very same evening.
We are publishing detailed information on the security vulnerabilities and the measures we have taken on our EGOCMS blog:
Critical PHP security vulnerabilities – information and security updates
SaaS.de is running smoothly – and even faster since the cluster migration
Regardless of the latest security bulletins, we have migrated our SaaS.de infrastructure to a new cluster.
The result: SaaS.de continues to run stably and has even been responding faster since the migration.
Our customers therefore benefit from a more powerful infrastructure and shorter response times in their day-to-day work.
Security and transparency are our top priorities
As a provider of business-critical software, we take the security and availability of our systems very seriously.
When security-related incidents occur, we assess their impact on our products, take the necessary measures and inform our customers promptly and transparently.
This is precisely what we have done in response to the recent PHP security vulnerabilities.
Our conclusion: SaaS.de is running reliably as usual. The applications are not directly affected by the current PHP security vulnerabilities; our PHP-based information pages have already been updated; and there is no need for our SaaS.de customers to take any action.
You can continue to use SaaS.de as normal.