PHP services are down

Two critical remote-code-execution flaws in PHP (CVE-2026-109618 and CVE-2026-109619) were leaked on 20 October 2026. Exploits are expected to spread quickly once patches are published.

The PHP security team ships fixes on 21 October 2026 at 14:00 UTC. Until patched versions are deployed on this server, all PHP-based services (wallabag, freshrss, rss-bridge, privatebin, proxitok, binternet, librey) are taken offline as a precaution.

They will come back up as soon as they are running patched PHP.