Critical PHP CVE(s)
Identified
22 Oct 2026, 12:45 UTC The update of the systems is proceeding as planned. Concerns about the effectiveness of the security release have largely been resolved. A PHP core developer has confirmed an additional vulnerability, but it is unrelated to the previously announced issues and is not rated as critical. Most internal systems and other public services are back in operation. As no vendor patches are available yet for the regular status page, status updates will continue to be published on this page for the time being. The customer management portal and VPS management will remain offline for now while the situation continues to be monitored. A return to normal operation is planned for Sunday, 25 October 2026.
21 Oct 2026, 15:45 UTC There are indications that the published security release may not fully resolve the vulnerabilities. Until the situation has been clarified, all affected systems, including internal services and the customer management portal, will remain out of operation as a precaution. Further updates will be posted here.
21 Oct 2026, 15:00 UTC The update of the affected systems is proceeding as planned. Parts of the internal infrastructure are already back in operation. The security updates for the customer management portal have been applied. It will be released once the outstanding fixes for the underlying backend components are in place.
20 Oct 2026 The PHP-based public services were shut down as a precaution. VPS are not affected.
Reported
The PHP security team has published an unscheduled security release for two critical vulnerabilities, each rated CVSS 9.2. Read the announcement
To protect customer data, the PHP-based public services have been proactively shut down until the patches have been applied and verified. The VPS themselves are not affected and remain online. Only the VPS management interface is temporarily unavailable. Services will then be restored step by step. No definite time can be given at this point.
Appropriate action on customer-managed VPS systems is recommended as well.
In case of emergency: support@eth-services.de