Security maintenance: Short interruptions possible on PHP-based services

Summary

Security maintenance: Short interruptions possible on PHP-based services

Websites and hosting at IONOS are protected. Two critical vulnerabilities in the PHP core were disclosed yesterday. Attackers could exploit them to run their own code on a website and gain access to customer data. PHP installations worldwide are affected, regardless of hosting provider. On October 21, 2026, the PHP project released security updates to fix these vulnerabilities. At IONOS, PHP is used by services including Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud and HiDrive Next. IONOS already rolled out the official updates across all platforms it operates itself. Customers do not need to take any action. Anyone running PHP themselves—for example, on a VPS or dedicated server—should install the update for the [latest PHP version](http://www.php.net) immediately. IONOS implemented additional protective measures before the updates were released. Its hosting platforms use customized PHP configurations and active firewall rules to block suspicious requests and reduce risk. However, only the official update can permanently fix the vulnerabilities. Beware of phishing: Fraudsters often exploit vulnerabilities like these in phishing attempts, sending fake emails to obtain login credentials. IONOS advises customers not to click links in emails referring to the PHP vulnerabilities or enter their login details. Further information regarding the security vulnerability can be found at <a href="https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/">https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/</a>

• Started

  Oct 21, 2026 · 11:31 AM

• Resolved

  Oct 22, 2026 · 6:10 AM

• Duration

  18h 39m

• Severity

  Major

• ◆

  Identified

  Oct 21 · 11:31 AM IONOS

  <b>What’s happening?</b> A critical security gap has been found in PHP, a technology used by many websites and web applications worldwide. The PHP developers and national security authorities have issued urgent warnings and recommend installing the security update immediately, as attacks are expected within hours. To protect you and your data, we’re installing the security update across our systems right now. We expect to be finished within the next 24 hours. <b>What does this mean for you?</b> While we update our systems, some websites and services may be slow or briefly unavailable. We’re taking this step to protect you. If you run a self-managed application, for example on a VPS or Bare Metal Server, please install the PHP security update as soon as possible to protect your systems. You can find more information here: https://www.php.net/ Thank you for your patience and understanding.

• ◆

  Identified

  Oct 21 · 11:55 AM IONOS

  We will post an update as soon as new information becomes available.

• ◆

  Identified

  Oct 21 · 5:03 PM IONOS

  We are continuing to work on restoring these features (services).

• ◆

  Identified

  Oct 22 · 12:51 AM IONOS

  We are still working on resolving the technical issue. Thank you for your patience.

• ◆

  Identified

  Oct 22 · 3:12 AM IONOS

  The Website Builder and IONOS Control Panel systems are stable and all services are functioning normally again.

• ◉

  Monitoring

  Oct 22 · 3:45 AM IONOS

  The systems are stable and all services are functioning normally again. Further information regarding the security vulnerability can be found at <a href="https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/">https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/</a>

• ✓

  Resolved

  Oct 22 · 6:10 AM IONOS

  Websites and hosting at IONOS are protected. Two critical vulnerabilities in the PHP core were disclosed yesterday. Attackers could exploit them to run their own code on a website and gain access to customer data. PHP installations worldwide are affected, regardless of hosting provider. On October 21, 2026, the PHP project released security updates to fix these vulnerabilities. At IONOS, PHP is used by services including Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud and HiDrive Next. IONOS already rolled out the official updates across all platforms it operates itself. Customers do not need to take any action. Anyone running PHP themselves—for example, on a VPS or dedicated server—should install the update for the [latest PHP version](http://www.php.net) immediately. IONOS implemented additional protective measures before the updates were released. Its hosting platforms use customized PHP configurations and active firewall rules to block suspicious requests and reduce risk. However, only the official update can permanently fix the vulnerabilities. Beware of phishing: Fraudsters often exploit vulnerabilities like these in phishing attempts, sending fake emails to obtain login credentials. IONOS advises customers not to click links in emails referring to the PHP vulnerabilities or enter their login details. Further information regarding the security vulnerability can be found at <a href="https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/">https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/</a>