As of 22 October 2026
Since 21 October 2026 it has been in the news: a critical security vulnerability in PHP, known as “PHP2Shell”. If you use Log+Key, you may be wondering right now whether your key data is at risk. Or your IT team is asking you.
The short answer: No. Log+Key is not affected, and you do not need to do anything.
You can read the slightly longer answer here, together with a short checklist for the systems in your organisation that might be affected after all.
What is behind PHP2Shell
PHP is a programming language that a large part of the internet runs on: many websites and content management systems such as WordPress, TYPO3 or Craft CMS, online shops and tools such as Nextcloud.
On 21 October 2026, the PHP project closed two vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Under certain conditions, they allow attackers to run malicious code on a server remotely, without having to log in first. The PHP security team rates both at 9.2 out of a possible 10 points. First attack attempts have already been observed.
Any server on which PHP answers requests from the internet and has not yet been updated is at risk. The vulnerability is only closed by an updated PHP version.
Why Log+Key is not affected
The vulnerability lies in PHP itself. Log+Key does not use PHP:
- The software: Log+Key is written in TypeScript and runs on Node.js. This is a separate runtime environment that has nothing to do with PHP. The vulnerability cannot occur there.
- Terminals, smartphones and computers: Log+Key runs in the browser on all devices. Nothing is installed that you would need to update.
- NFC tags: The tags only carry an identifier and an address. They contain no software.
- Our website log-key.de: It consists of static pages, works without PHP and is technically completely separate from Log+Key.
What this means for you: no updates, no changed settings, no interruption. Log+Key keeps running as usual, on servers in Germany.
For once, a security notice that can be kept short.
What you should check in your organisation now
Log+Key is not affected. Other systems your team works with may well be. Typical candidates:
- your website, especially if it runs on WordPress, TYPO3, Contao, Joomla, Drupal or Craft CMS
- intranet, Nextcloud, online shop, booking or ticketing systems
- your own servers running PHP applications
Ask your IT team, your hosting provider or your agency whether PHP has been updated to a fixed version there. The PHP project names versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older PHP versions no longer receive regular updates from the PHP project. Here, an update via the provider of the Linux distribution or an upgrade to a supported version will help.
Good to know: with managed hosting, many providers have already installed the update themselves. With your own servers, whether dedicated or in the cloud, the operator is responsible. If a system cannot be updated straight away, security authorities advise taking it offline until then.
We are keeping an eye on it
We continue to monitor the situation. Should anything change in our assessment, we will let you know immediately.
We are happy to answer any questions at hello@log-key.de. You can read how we protect your data in general under Security at Log+Key.
Source: Security notice from the PHP project of 21 October 2026
