Important security notice: Critical PHP vulnerabilities

Web analytics, uncovered.

Discover the trends, insights and ideas worth knowing.

Dear Matomo Community,

We are contacting you regarding two critical security vulnerabilities affecting PHP, disclosed on October 21, 2026.

These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both have a severity score of 9.2/10 (CVSS) and could potentially allow attackers to execute malicious code on affected servers without authentication.

These vulnerabilities affect PHP itself, not Matomo directly. However, because Matomo relies on PHP, some installations may be affected.

If you use Matomo Cloud: No action is required.
Our team has applied the necessary security updates, and Matomo Cloud infrastructure is protected. We manage these updates on your behalf.

If you use Matomo On-Premise: Immediate action is required.
If you host Matomo on your own infrastructure, we strongly recommend updating PHP as soon as possible.
The following patched PHP versions are available:
PHP BranchPatched Version PHP 8.58.5.12 PHP 8.48.4.27 PHP 8.38.3.36 PHP 8.28.2.35
Please take the following steps:

Important: Updating Matomo alone does not fix these vulnerabilities. Your underlying PHP installation must be updated.
More information
For additional details, please read our official security announcement:
Critical PHP Security Vulnerabilities: Important Update for Matomo Users

We take security seriously and remain committed to keeping your analytics environment secure.

Thank you for your attention and your trust in Matomo.

Best regards,
The Matomo Team