Critical PHP security update: what it means for Kimai users

What happened

On 20 October 2026, the PHP security team announced an emergency security release that fixes two critical vulnerabilities in PHP itself, both rated 9.2 out of 10. The release is scheduled for 21 October 2026 at 14:00 UTC.

The vulnerabilities are not in Kimai’s code. They are in the PHP runtime, so every PHP application worldwide is potentially affected. Updating Kimai alone won’t fix this: PHP itself has to be updated on every server that runs it.

What we are doing

We’ve been tracking this closely since the evening of 20 October and have taken precautions across our infrastructure. Our team is on standby and will apply the official PHP fix as soon as it’s published. We’ll update this post as the situation develops.

Important for Kimai Cloud customers

You don’t need to do anything to get the fix. We’ll update all Kimai Cloud servers right after the PHP security release is published.

During the day, you may notice short interruptions or occasional errors while we apply additional security measures and install the updates. We’re sorry for the inconvenience. The security of our platform is our top priority, so this time we can’t wait for a planned maintenance window.

If something doesn’t work as expected, contact us at support@kimai.org.

Self-hosted Kimai with Docker

The PHP runtime is part of our Docker image. Once PHP publishes the fix, we’ll release updated Kimai images, and you can update your installation by pulling the new image. We’ll post the exact image tag in https://github.com/kimai/kimai/pull/6262 as soon as it’s available.