Initial information - 21 October 2026 - 1.00 p.m.
Several services offered by Restena are affected by a general vulnerability in the PHP programming language. As a protection measure, Restena is putting in place restrictions on its own and customer hosted websites. Due to these restrictions, the impact relates to:
- websites hosted by Restena via the ‘Website’ service ;
- the configured and secure web interface ‘Webmail’ ;
- authentication via the 'eduID Luxembourg' service.
By extension, this also applies to access to all websites managed by Restena.
As of the time of this alert’s publication, no malfunctions have been detected in the aforementioned services. However, it is possible that, between now and the official release of the patch for the vulnerability announced by the relevant authorities at 4:00 p.m. today, and its deployment on our technical infrastructure, users of these services may be unable to access them.
→ While Restena’s technical teams are already prepared to deploy the patch as soon as it is released, all affected services may return to normal operation before the end of the day - Wednesday 21 October 2026. As things stand, no specific timetable can be guaranteed.
Update - 21 October 2026 - 6.00 p.m.
The hosting service has been updated. Patches for the vulnerability in the PHP programming language have been deployed across our technical infrastructure and have rectified the reported issues.
All affected services have been operating normally since Wednesday 21 October 2026 before 5.00 p.m.
Restena’s technical teams remain on standby, however, and are monitoring the situation closely; they will take appropriate action if necessary.
→ We thank all our users for their patience.
Update - 21 October 2026 - 7.00 p.m.
The two critical vulnerabilities in PHP that have been identified may be exploited by hackers. Considering the severity of the vulnerabilities, the probability of exploitation is very high, as explained by the Computer Incident Response Center Luxembourg (CIRCL) on their publication ‘TR-102 Critical Remote Code Execution Vulnerabilities in PHP - CVE-2026-109618 and CVE-2026-109619’.
Since a few hours the patches for the two PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 are available for PHP versions 8.2, 8.3, 8.4 as well as 8.5 following that link : https://www.php.net/archive/2026.php#2026-10-21-5
However, older versions will not receive the patch and it is recommended by authorities to avoid exposing applications with deprecated versions to the Internet.
The impacted systems are all PHP versions ranging back to at least PHP 5.
The recommendations are the following:
- For PHP Versions >= 8.2: Apply the patch immediately
- For PHP Versions < 8.2: Isolate systems from the internet