Critical PHP security vulnerability: OpenCloud is not affected.

PHP2Shell: Critical vulnerabilities in PHP

On 21 October 2026, the PHP project released security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. (Details at Cert-EU)

Under certain conditions, both vulnerabilities could allow arbitrary code to be executed on a server – known as remote code execution (RCE). Under specific circumstances, exploitation may also be possible without prior authentication.

With a CVSS v4.0 score of 9.2 each, both vulnerabilities are classified as critical.

Applications using vulnerable versions of PHP may be affected. Whether a specific installation is actually vulnerable depends, amongst other things, on the PHP version used, the configuration and the relevant technical requirements.

Operators of such systems should therefore review the published security advisories and apply the necessary updates without delay.

Why OpenCloud takes a different approach

OpenCloud is built on an architecture designed to be cloud-native from the ground up. The compiled programming language Go is used as the central backend technology.

This approach offers several advantages:

• No PHP runtime environment: The Go-based backend services are not affected by security vulnerabilities in the PHP interpreter.
• Modular microservices: Individual services are clearly separated from one another and can be developed, updated and scaled independently.
• No traditional SQL database: OpenCloud uses a POSIX-compatible file system to manage files and metadata, without requiring a separate relational database.
• Cloud-native scalability: The architecture supports modern operating environments with containers and Kubernetes.
• Modern memory management: Go offers automatic memory management that reduces certain types of common memory errors.

These technological decisions form the basis for a high-performance, scalable and long-term maintainable platform for file management, file sharing and digital collaboration.

Security doesn’t start with the next patch

Regular security updates are essential – regardless of which programming language is used. However, a sustainable security strategy begins right at the development stage: with the deliberate choice of architecture and technologies, a clear separation of components, and the reduction of unnecessary dependencies.

Of course, no software is fundamentally free from potential security vulnerabilities. Even modern technologies require continuous maintenance, security audits and updates. – For us, however, security is not just a matter of rapid updates, but also the result of deliberate decisions made during the development and architecture of software. This is the approach we take with OpenCloud.