Legacy customer control panel taken offline as a precaution

Update timeline

1. investigating Oct 13, 2026, 11:25 AM UTC

   As a precaution, we have taken our legacy customer control panel offline. It runs on PHP and is affected by two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), for which active exploitation has been reported. We have no evidence that customer data or systems have been affected. Impact: You cannot log in to the legacy control panel until further notice. Your servers, VPS, storage and other services are not affected and continue to run normally. Workaround: Manage your services via new.contabo.com or the API. You are able to login with your legacy panel credentials. Recommended actions: If you run PHP applications on your own Contabo services, apply the PHP security update as soon as your distribution or vendor releases it. Configuration workarounds are ineffective. Be alert to phishing emails asking you to log in or “verify” your account. We never ask for your password by email. Next steps: We will restore the legacy panel once the patch has been applied and verified, and will post updates here.

2. monitoring Oct 21, 2026, 01:05 PM UTC

   Dedicated server control is currently shutdown as well.

3. monitoring Oct 21, 2026, 01:21 PM UTC

   Contabo blog and full monitoring services are also shutdown until pattched.

4. monitoring Oct 21, 2026, 03:38 PM UTC

   Contabo blog and full monitoring are patched and available again.

5. monitoring Oct 21, 2026, 07:31 PM UTC

   Legacy CCP is patched and online again.

6. monitoring Oct 22, 2026, 10:55 AM UTC

   All services are patched and online again.