On 21 October 2026 the PHP project closed two critical security flaws: CVE-2026-109618 and CVE-2026-109619, also called “PHP2Shell” in reports. Both are rated 9.2 out of 10 (CVSS 4.0) and allow attackers to run their own code on the server without logging in. If you run Matomo yourself, update PHP now rather than waiting for the next maintenance window.
What is known
- Affected are, according to PHP, all installations that serve web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php.
- Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions received the fixes in advance and ship their own packages.
- PHP 8.1 and older no longer get updates from the PHP project. According to CERT-EU, all versions back to at least PHP 5 are vulnerable.
- The German BSI rates the situation as orange: measures must be taken without delay. It considers broad exploitation within a few hours of the patches being released likely.
- Public exploits already exist, according to RUS-CERT at the University of Stuttgart. RUS-CERT reproduced one of them on a test system.
Why Matomo servers are particularly exposed
Matomo is a PHP application, and its tracking endpoint has to be reachable for every visitor of the measured websites. There is no login there, and the endpoint cannot be put behind a VPN without switching off tracking. Requests without a login are exactly what these flaws exploit.
Add to that what sits on a Matomo server: raw visit data, database credentials, API tokens and the tracking files. The file matomo.js and the Tag Manager containers are loaded on every measured website. Whoever takes over the server can change them and so run their own code on all of these websites.
What to do now
- Check the version that serves web requests.
php -vonly shows the command-line version; PHP-FPM or Apache may use a different one. In Matomo you find the version under Administration, System, System Check. - Update. Via your distribution’s package manager, your hosting panel or a new build of your containers. Distributions use their own version numbers, so their security notice is what counts.
- Restart the services. Running PHP-FPM processes and Apache keep using the old version until they are restarted. Then check the version again, including for the archiving cron job.
- Replace old PHP versions. If you still run PHP 8.1 or older, the PHP project provides no fix. Before switching, check whether your Matomo version and your plugins run on the new PHP version.
- Look for traces. Matomo’s System Check reports files that do not belong to the installation under file integrity. Also check the users with super user access, new API tokens, cron jobs and new PHP files in the web directory.
The emergency measures in the PHP notice, such as removing the memory limit, do not make an installation safe according to PHP. With Matomo, removing the memory limit can also let large reports exhaust the whole server. If you cannot update straight away, take the server offline until the update. It costs tracking data, but it is better than a compromised server.
If you suspect an attack: isolate the server, preserve the web server and PHP logs, and only then clean up.
Operation by feinwerk.io
Matomo instances run by our sister brand feinwerk.io get security updates and patches as soon as they are available. You do not have to do anything. The same applies to servers that feinwerk.io looks after for you under SLA operations.
Do you run Matomo yourself and want to know whether your server is up to date and properly hardened? With Security & hardening I check PHP, the web server and the operating system too, and in a Matomo audit updates and operations as well.
Sources
As of 21 October 2026
Questions about your setup?
In an intro call we'll look at your situation together.
Book an intro call