Critical PHP security update — temporary shutdown of all servers

We are still waiting for CloudLinux PHP updates. Patched packages have been released for some PHP versions, but remain unavailable for most, including versions still officially supported by the PHP project. We are updating servers wherever the required packages are available.

We understand the significant impact of this downtime. However, bringing affected websites back online before patching would expose them to a serious risk of being hacked—meaning an attacker could gain unauthorised access to your website and its data.

Depending on the access gained, an attacker could steal sensitive information, including customer data; change or delete website files and databases; or use your website to spread malware or host scams. This could harm your visitors, damage your business’s reputation and cause data loss. Recovering from an attack could also result in a much longer outage while your website is cleaned and restored. This describes the potential risks, not confirmation that your website has been hacked.

All our web hosting servers run Imunify360, although not every managed server has this protection. A web application firewall (WAF) may block certain malicious requests, but it does not fix the underlying vulnerability. Vendors’ protection against known attack patterns should not be interpreted as protection against every possible exploit. Unknown or modified attack patterns may bypass those rules, leaving unpatched websites vulnerable.

These mitigations are an additional safeguard, not a substitute for installing the PHP security updates. We have therefore kept affected services offline rather than relying on mitigations alone. We continue to assess each server individually and will bring each service back online only after the required PHP security updates have been installed and the necessary security checks are complete.

Thank you for your continued patience.

PHP has released the security updates, but our vendors, including CloudLinux, need time to prepare and distribute updated packages for their platforms.

Meanwhile, we are checking each server individually and applying updates where available. Each server will be brought back online as soon as its required updates and security checks are complete.

PHP has now released the security updates, and we are updating servers where patched packages are available. We will update the remaining servers as soon as their vendors release the required packages. There is still no confirmed ETA for full service restoration.

Temporary mitigations have not been fully validated by us and should not be considered a complete fix. They may make exploitation harder, but exploitation may still be possible.

We understand the impact on your business. Our own services and operations are also affected, and restoring services as quickly and safely as possible remains our priority.

Critical PHP security update — temporary website and panel downtime

Following the announcement of critical PHP security vulnerabilities, we are temporarily taking websites, web applications, hosting control panels and our customer panel offline as a precaution while we prioritise securing our infrastructure.

Which services are affected?

• Websites and web applications: WordPress websites, including their administration dashboards, other hosted websites, web applications and their associated APIs will be temporarily unavailable.
• Hosting control panels: Access to Plesk, DirectAdmin and cPanel will be temporarily unavailable. You will not be able to manage your hosting services through these panels during this period.
• Our customer panel: Our customer panel will also be temporarily unavailable. Please contact us directly at support@yourwebhoster.eu for support during this period.
• Webmail: Browser-based email access may also be unavailable, even where the underlying email service remains operational.

In most cases, sending and receiving email through email applications such as Outlook, Apple Mail and mobile mail apps is expected to continue working. However, availability may vary by server, and temporary email interruptions may occur during maintenance.

Updates and service restoration

Security fixes are scheduled for 21 October 2026 at 14:00 UTC (16:00 CEST / Netherlands time). Our infrastructure uses Plesk, DirectAdmin and cPanel, alongside CloudLinux-provided PHP versions. Each vendor has its own release process, meaning patched packages may become available at different times. The scheduled PHP release time is therefore not an estimated restoration time.

We are monitoring vendor releases and will apply the necessary security updates as soon as they become available for each environment. Affected services will be brought back online after the required updates and checks have been completed. We cannot yet provide a confirmed restoration time.

All progress and service-restoration updates will be published at status.yourwebhoster.eu. We recommend subscribing to updates on this status page so that you are automatically notified of new developments.

Contact and support

For support or questions, please email support@yourwebhoster.eu. Response times may be longer than usual while we prioritise security updates and service restoration, but we will address requests as quickly as possible.

We apologise for the disruption and appreciate your patience.

Following the announcement of critical PHP security vulnerabilities, we are temporarily taking all servers offline as a precaution. Services hosted on these servers will be unavailable during this period while we prioritise securing our infrastructure.

Security fixes are scheduled for 21 October 2026 at 14:00 UTC (16:00 CEST / Netherlands time). Our infrastructure uses Plesk, DirectAdmin and cPanel, alongside CloudLinux-provided PHP versions. Each vendor has its own release process, meaning patched packages may become available at different times. The scheduled PHP release time is therefore not an estimated restoration time.

We are monitoring vendor releases and will apply the necessary security updates as soon as they become available for each environment. Servers will be brought back online after the required updates and checks have been completed. We cannot yet provide a confirmed restoration time. We will publish progress and service-restoration updates on this status page.

For support or questions, please email support@yourwebhoster.eu. Response times may be longer than usual while we prioritise security updates and service restoration, but we will address requests as quickly as possible.

We apologise for the disruption and appreciate your patience.