Update 5: Enreach measures due to serious vulnerabilities in PHP

Dear Partners

we are writing to inform you about preventive security measures Enreach is taking in response to recently discovered serious vulnerabilities in PHP. PHP is a widely used programming language for web applications, and Enreach uses it too.

Under certain circumstances, malicious actors could exploit these vulnerabilities to gain unauthorized access to systems. Enreach takes this threat very seriously.

It's regarding the following CVS's:  CVE-2026-109618 and CVE-2026-109619

https://www.php.net/archive/2026.php#2026-10-20-1
 
Update: The first PHP patch versions are currently being validated. In parallel, we are rolling them out step by step to an initial set of systems. Once validation is complete, the rollout to all remaining systems will follow.
 

What does this mean for our services?
To protect our systems, our partners and your customers, Enreach has decided as a precaution to temporarily take some applications and services offline or restrict their availability.

The following applications currently have limited availability or are unavailable at all and additional Services may follow:

- UPDATE: Operator incl. API-Access online and working but with smaller Restrictions. Please see the Message von Operator.

- UPDATE ECD: Fully Functional (Desktop and WebApp)

- CDC reduced functionality 
* Login via Operator-Password working
* Telephone - Functionality working

The Impact currently is:
* No Loing via SingleSignOn (SSO) bei CDC
* No Signalization of new Voicemails
* No Voicemail Playback
* Shomi - No Audio Playback
* Not possible to add/edit contacts personal phonebook
* No numbering plan override via App, please use the Functionality via 8815 (Admin or Users with permission of Time-Configuration).

- UPDATE: ECD Teams APP working again

- UPDATE: Enreach WebSites useable (In all Regions)

- Enreach Partner Portals

Our technical teams are investigating the impact and putting the necessary security measures in place. For this, we depend on the patches released by the PHP project. Once we have confirmed that the services are secure, we will bring them back online in phases and let you know as soon as possible.

What can you expect from us?
We understand that these measures may affect your daily work and that of your customers. The security and reliability of our services are our top priority.
We will keep you informed about relevant developments, the availability of the affected applications, and when services will be restored.

What do we ask of you?
Please allow for possible restrictions in the applications listed above and, where necessary, let your customers know about the temporary impact.

Thank you for your understanding and cooperation.