Omeka.net Updated to Address Critical PHP Security Vulnerabilities

On October 21, 2026, the PHP project announced fixes for two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP installations that serve web requests. In some configurations, these flaws could allow an attacker to run code on a server without logging in.

We updated PHP across all Omeka.net servers yesterday, the same day the fixes were released. Every Omeka.net site is now running a patched version of PHP and is protected against these vulnerabilities.

Do I need to do anything?

No. Omeka.net is a fully hosted service, so we handle server software and security updates for you. There is nothing you need to change, install, or reconfigure, and your site’s content, items, collections, and exhibits are unaffected.

Our commitment

Keeping your collections secure is one of our top priorities. We monitor security announcements for the software Omeka.net depends on and apply critical fixes as quickly as possible.

If you notice anything unusual on your site or have questions, please contact us and we’ll be glad to help.

Back to News