Contabo incident
Legacy customer control panel taken offline as a precaution
Resolved after 56 minutes, on October 21, 2026.
As a precaution, we have taken our legacy customer control panel offline. It runs on PHP and is affected by two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), for which active exploitation has been reported. We have no evidence that customer data or systems have been affected. Impact: You cannot log in to the legacy control panel until further notice. Your servers, VPS, storage and other services are not affected and continue to run normally. Workaround: Manage your services via new.contabo.com or the API. If you need an action that is only available in the legacy panel, please contact support. Recommended actions: If you run PHP applications on your own Contabo services, apply the PHP security update as soon as your distribution or vendor releases it. Configuration workarounds are ineffective. Be alert to phishing emails asking you to log in or “verify” your account. We never ask for your password by email. Next steps: We will restore the legacy panel once the patch has been applied and verified, and will post updates here.
Update timeline
- investigating Oct 21, 2026, 11:25 AM UTC
As a precaution, we have taken our legacy customer control panel offline. It runs on PHP and is affected by two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), for which active exploitation has been reported. We have no evidence that customer data or systems have been affected. Impact: You cannot log in to the legacy control panel until further notice. Your servers, VPS, storage and other services are not affected and continue to run normally. Workaround: Manage your services via new.contabo.com or the API. If you need an action that is only available in the legacy panel, please contact support. Recommended actions: If you run PHP applications on your own Contabo services, apply the PHP security update as soon as your distribution or vendor releases it. Configuration workarounds are ineffective. Be alert to phishing emails asking you to log in or “verify” your account. We never ask for your password by email. Next steps: We will restore the legacy panel once the patch has been applied and verified, and will post updates here.
Your product runs on more than Contabo
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services