Critical security vulnerabilities in PHP – security updates installed
On October 21, 2026, two critical security vulnerabilities in the PHP programming language were disclosed that, under certain circumstances, could enable unauthorized access to web servers.
We responded immediately and activated additional protective measures on our servers even before the security updates were released.
In the meantime, we have applied the necessary security fixes to all PHP versions we offer. This also applies to older PHP versions that are no longer officially supported by the PHP project.
To protect our infrastructure and your data, we also temporarily shut down some of our own services as a precaution. These will be made fully available again once the security checks have been completed. Our customers' websites were not affected by these shutdowns.
Based on our current knowledge, we have no specific indications of successful exploitation of the vulnerabilities on our systems. However, exploitation before the security updates were installed cannot be ruled out entirely.
Important notice: We therefore recommend that you check your websites and applications for unusual changes, especially unknown files, unexpected modifications, or newly created user accounts.
Our technicians continue to monitor the systems and investigate suspicious activity.
Further technical information can be found in the official security announcement from the PHP project.
There was quite a lot going on online. Let me say thanks to all-inkl.com for reacting so quickly. The only thing that really rubbed me the wrong way was that I could no longer take echtma.de offline, since the administration for it was also shut down.
Well, nothing happened, and since the announcement quoted above, I feel better again.
This post has been automatically translated.