Security maintenance: Short interruptions possible on PHP-based services

Update timeline

1. identified Oct 21, 2026, 03:31 PM UTC

   What’s happening? A critical security gap has been found in PHP, a technology used by many websites and web applications worldwide. The PHP developers and national security authorities have issued urgent warnings and recommend installing the security update immediately, as attacks are expected within hours. To protect you and your data, we’re installing the security update across our systems right now. We expect to be finished within the next 24 hours. What does this mean for you? While we update our systems, some websites and services may be slow or briefly unavailable. We’re taking this step to protect you. If you run a self-managed application, for example on a VPS or Bare Metal Server, please install the PHP security update as soon as possible to protect your systems. You can find more information here: https://www.php.net/ Thank you for your patience and understanding.

2. identified Oct 21, 2026, 03:55 PM UTC

   We will post an update as soon as new information becomes available.

3. identified Oct 21, 2026, 09:03 PM UTC

   We are continuing to work on restoring these features (services).

4. identified Oct 22, 2026, 04:51 AM UTC

   We are still working on resolving the technical issue. Thank you for your patience.

5. identified Oct 22, 2026, 07:12 AM UTC

   The Website Builder and IONOS Control Panel systems are stable and all services are functioning normally again.

6. monitoring Oct 22, 2026, 07:45 AM UTC

   The systems are stable and all services are functioning normally again. Further information regarding the security vulnerability can be found at https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/

7. resolved Oct 22, 2026, 10:10 AM UTC

   Websites and hosting at IONOS are protected. Two critical vulnerabilities in the PHP core were disclosed yesterday. Attackers could exploit them to run their own code on a website and gain access to customer data. PHP installations worldwide are affected, regardless of hosting provider. On October 21, 2026, the PHP project released security updates to fix these vulnerabilities. At IONOS, PHP is used by services including Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud and HiDrive Next. IONOS already rolled out the official updates across all platforms it operates itself. Customers do not need to take any action. Anyone running PHP themselves—for example, on a VPS or dedicated server—should install the update for the [latest PHP version](http://www.php.net) immediately. IONOS implemented additional protective measures before the updates were released. Its hosting platforms use customized PHP configurations and active firewall rules to block suspicious requests and reduce risk. However, only the official update can permanently fix the vulnerabilities. Beware of phishing: Fraudsters often exploit vulnerabilities like these in phishing attempts, sending fake emails to obtain login credentials. IONOS advises customers not to click links in emails referring to the PHP vulnerabilities or enter their login details. Further information regarding the security vulnerability can be found at https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/