On 21 October 2026, the German Federal Office for Information Security (BSI) warned of a critical security vulnerability in PHP. PHP is the language that powers WordPress, Shopware, Joomla and many other websites, among others. Through this vulnerability, attackers could, under certain circumstances, have executed their own code on a server.
What we did
- Updated the same evening: All of our servers received the patched PHP version. The patched versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- Checked for intrusions: Afterwards, we examined every server for traces of an attack. There were no findings.
- Status page: You can read how it all went on our status page.
What you need to do
If you use web hosting with us: nothing. We have applied the update for you, and your websites continue to run on the patched version.
If you operate a cloud server with us, you manage the operating system on it yourself. Please check whether PHP is installed there and whether it is on one of the versions listed above, and otherwise apply your distribution's updates. If you would like help with this, please contact our support team.
We are happy to answer questions about your package personally, by phone or via our contact form.