Critical PHP security update — temporary shutdown of all servers

Update timeline

1. investigating Oct 21, 2026, 12:23 PM UTC

   Following the announcement of critical PHP security vulnerabilities, **we are temporarily taking all servers offline as a precaution**. Services hosted on these servers will be unavailable during this period while we prioritise securing our infrastructure. Security fixes are scheduled for **21 October 2026 at 14:00 UTC (16:00 CEST / Netherlands time)**. Our infrastructure uses **Plesk, DirectAdmin and cPanel**, alongside **CloudLinux-provided PHP versions**. Each vendor has its own release process, meaning patched packages may become available at different times. The scheduled PHP release time is therefore **not an estimated restoration time**. We are monitoring vendor releases and will apply the necessary security updates as soon as they become available for each environment. Servers will be brought back online after the required updates and checks have been completed. **We cannot yet provide a confirmed restoration time.** We will publish progress and service-restoration updates on this status page. **For support or questions, please email [email protected].** Response times may be longer than usual while we prioritise security updates and service restoration, but we will address requests as quickly as possible. We apologise for the disruption and appreciate your patience.

2. investigating Oct 21, 2026, 12:39 PM UTC

   ## Critical PHP security update — temporary website and panel downtime Following the announcement of critical PHP security vulnerabilities, **we are temporarily taking websites, web applications, hosting control panels and our customer panel offline as a precaution** while we prioritise securing our infrastructure. ### Which services are affected? - **Websites and web applications:** WordPress websites, including their administration dashboards, other hosted websites, web applications and their associated APIs will be temporarily unavailable. - **Hosting control panels:** Access to **Plesk, DirectAdmin and cPanel** will be temporarily unavailable. You will not be able to manage your hosting services through these panels during this period. - **Our customer panel:** Our customer panel will also be temporarily unavailable. Please contact us directly at **[email protected]** for support during this period. - **Webmail:** Browser-based email access may also be unavailable, even where the underlying email service remains operational. **In most cases, sending and receiving email through email applications such as Outlook, Apple Mail and mobile mail apps is expected to continue working.** However, availability may vary by server, and temporary email interruptions may occur during maintenance. ### Updates and service restoration Security fixes are scheduled for **21 October 2026 at 14:00 UTC (16:00 CEST / Netherlands time)**. Our infrastructure uses **Plesk, DirectAdmin and cPanel**, alongside **CloudLinux-provided PHP versions**. Each vendor has its own release process, meaning patched packages may become available at different times. The scheduled PHP release time is therefore **not an estimated restoration time**. We are monitoring vendor releases and will apply the necessary security updates as soon as they become available for each environment. Affected services will be brought back online after the required updates and checks have been completed. **We cannot yet provide a confirmed restoration time.** **All progress and service-restoration updates will be published at [status.yourwebhoster.eu](https://status.yourwebhoster.eu). We recommend subscribing to updates on this status page so that you are automatically notified of new developments.** ### Contact and support **For support or questions, please email [email protected].** Response times may be longer than usual while we prioritise security updates and service restoration, but we will address requests as quickly as possible. We apologise for the disruption and appreciate your patience.

3. investigating Oct 21, 2026, 02:14 PM UTC

   PHP has now released the security updates, and **we are updating servers where patched packages are available**. We will update the remaining servers as soon as their vendors release the required packages. There is still **no confirmed ETA for full service restoration**. Temporary mitigations have not been fully validated by us and should not be considered a complete fix. They may make exploitation harder, but exploitation may still be possible. We understand the impact on your business. Our own services and operations are also affected, and restoring services as quickly and safely as possible remains our priority.

4. investigating Oct 21, 2026, 03:22 PM UTC

   PHP has released the security updates, but our vendors, including **CloudLinux**, need time to prepare and distribute updated packages for their platforms. Meanwhile, we are checking each server individually and **applying updates where available**. Each server will be brought back online as soon as its required updates and security checks are complete.

5. identified Oct 21, 2026, 07:39 PM UTC

   We are still waiting for **CloudLinux PHP updates**. Patched packages have been released for some PHP versions, but remain unavailable for most, including versions still officially supported by the PHP project. **We are updating servers wherever the required packages are available.** We understand the significant impact of this downtime. However, bringing affected websites back online before patching would expose them to a serious risk of **being hacked—meaning an attacker could gain unauthorised access to your website and its data**. Depending on the access gained, an attacker could steal sensitive information, including customer data; change or delete website files and databases; or use your website to spread malware or host scams. This could harm your visitors, damage your business’s reputation and cause data loss. Recovering from an attack could also result in a much longer outage while your website is cleaned and restored. **This describes the potential risks, not confirmation that your website has been hacked.** All our web hosting servers run **Imunify360**, although not every managed server has this protection. A web application firewall (WAF) may block certain malicious requests, but **it does not fix the underlying vulnerability**. Vendors’ protection against known attack patterns should not be interpreted as protection against every possible exploit. Unknown or modified attack patterns may bypass those rules, leaving unpatched websites vulnerable. These mitigations are an additional safeguard, not a substitute for installing the PHP security updates. **We have therefore kept affected services offline rather than relying on mitigations alone.** We continue to assess each server individually and will bring each service back online only after the required PHP security updates have been installed and the necessary security checks are complete. Thank you for your continued patience.

6. identified Oct 21, 2026, 11:25 PM UTC

   CloudLinux has acknowledged that its earlier release information was incorrect: the announced updates were for **TuxCare**, not the CloudLinux PHP packages we need. CloudLinux has now provided installation instructions that **differ from the usual update process**. We are reviewing these instructions and preparing to deploy the updates **as soon as possible**. Affected services will be restored after installation and security checks. There is still no confirmed restoration time.

7. resolved Oct 22, 2026, 03:04 AM UTC

   We've now resolved the incident. Thanks for your patience.