URGENT: Security Advisory – Critical PHP Vulnerabilities

General questions
1

Matomo On-Premise users: urgently update your server’s PHP to fix two critical security vulnerabilities. Updating Matomo alone won’t apply these fixes.

These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) may allow attackers to execute malicious code on affected servers.

Who is affected?

Customers running Matomo On-Premise installations using vulnerable PHP versions may be affected. These vulnerabilities are within PHP itself, rather than Matomo.

Cloud customers are do not need to make any changes.

Recommended actions

We strongly recommend that you:

  1. Check your PHP version – Confirm which version of PHP your Matomo server is running.
  2. Update PHP – Contact your server administrator or hosting provider to ensure PHP is updated to a version containing the latest security fixes.
  3. Verify the update – Confirm that the patched PHP version is running and that your Matomo installation continues to function as expected.

You can find the latest PHP security releases and updates on the official PHP website.

Important: Updating Matomo alone will not resolve these vulnerabilities. The PHP installation on your server must be patched.

As Matomo On-Premise is hosted on infrastructure managed by you or your hosting provider, PHP updates will need to be performed by your server administrator.

4

What if where are running docker image: matomo:latest?

running a docker compose up will result in the following versions:
Matomo version: 5.14.1 → 5.14.2 after running the update inside the container admin site.

MySQL version: 12.3.3-MariaDB-ubu2404

PHP version: 8.4.27

According to php dot net we should be fine since the docker image is 8.4.27
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.