Was Threema affected by the recently disclosed PHP vulnerabilities?

On October 21, 2026, two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP, a widely used scripting language, were announced. Later that day, the PHP team released the corresponding security updates.

Threema Work’s management cockpit and Threema Broadcast are partly based on PHP. As a precautionary measure, certain features, such as media uploads, were therefore temporarily disabled until the security updates became available.

While the security updates were being installed, which happened immediately after their release on the evening of October 21, 2026, Threema Work’s management cockpit, Threema Broadcast, and threema.com were temporarily unavailable.

Since then, all affected systems have been patched and are fully operational once again.

These third-party vulnerabilities did not affect the availability (or the security) of the Threema apps for Android, iOS, and the desktop.