Incident Response
Contact us

Live incident · PHP security release

Our PHP servers remain offline as a security precaution

Following the public disclosure of exploit information relating to two critical PHP vulnerabilities, we have maintained the precautionary shutdown of our PHP servers.

Both vulnerabilities have a severity rating of 9.2 out of 10, placing them in the Critical category.

We have explored a number of options to keep websites operational. However, now that exploit information for at least one of the vulnerabilities has appeared in the public domain, we have made the decision to keep our PHP servers offline until the official security update is available.

We recognise the disruption this causes and have not taken this decision lightly. Protecting our clients' websites and data remains our immediate priority.

Last updated

PHP security update
15:00 BSTScheduled · Wed, 21 Oct 2026Awaiting official release
Severity
2 CriticalCVSS v4.0 9.2 each
Our progress
Protecting and preparingStep 2 of 5
Service availability
Partial service outage

Services will be restored after the security updates have been applied and tested.

What to expect

  • Website access

    Some websites are being served from a cache, so visitors can still view them, although content may not be fully up to date and some interactive features may not work. Websites that run directly on PHP without a cache are completely unavailable, and visitors may see an error message.

  • Content management

    Access to Content Management Systems (CMS) is also unavailable. Clients cannot log in to make or publish website content changes.

  • Restoring services

    Once the official PHP security updates are available, our technical team will apply the necessary fixes, test websites and restore services when it is safe to do so.

  • Do I need to do anything?

    No action is required from clients at this stage. We will continue to provide updates as the situation develops.

How we’re handling it

  1. Vulnerabilities identifiedCompleteAdvance notification received concerning two critical PHP vulnerabilities.
  2. Protecting and preparingIn progressPHP servers taken offline as a precaution. Reviewing infrastructure and preparations for the official update.
  3. Applying security updatesPendingDeploying the officially released PHP security updates to our PHP servers.
  4. Testing and verificationPendingTesting websites and CMS functionality, and verifying successful patching.
  5. Restoring and monitoringPendingBringing services back online and monitoring stability and security.

Service status

Partial service outage

  • Hosting infrastructureAll client PHP servers were deliberately taken offline from 09:00 BST. Shutdown was completed by 09:21 BST.
    PHP servers offline
  • Client websitesWebsites that run directly on PHP without a cache are unavailable. Some websites are still available from a cache.
    Partially unavailable
  • Content managementCMS access, content editing and publishing are unavailable.
    Offline
  • PHP security patchOfficial security updates are scheduled for 15:00 BST, subject to confirmation.
    Awaiting release
  • Operational
  • At risk
  • Down
  • Maintenance
  • Pending

Updates

Newest first · times in UK time

  1. PreparingLatest

    Public exploit information disclosed — precautionary shutdown remains in place

    Since our earlier update, information demonstrating exploitation of the critical PHP vulnerabilities has continued to spread in the public domain, increasing the potential risk to affected systems.

    This is not a decision we have taken lightly. We recognise the disruption to our clients, but believe this is the responsible approach given the severity of the vulnerabilities and the evolving situation.

    The official PHP security release remains scheduled for 15:00 BST today. There is a possibility that this may be brought forward following recent developments, although this has not been confirmed.

    Websites that run directly on PHP and all CMS platforms will remain unavailable in the meantime. Some websites continue to be served from a cache.

    We are continuing to monitor developments closely and will provide another update once the official security release is available and our deployment plan is confirmed.

    No action is required from clients at this stage.

  2. Maintenance

    Shutdown complete

    All client PHP servers are now offline.

  3. Maintenance

    Decision to take PHP servers offline

    We took the decision to take all of our client PHP servers offline as a precaution, starting at 09:00 BST.

    Exploit information was circulating online and early attack attempts against PHP sites had been reported, while the official security update was not due until 15:00 BST. We judged that keeping servers online in the meantime posed too great a risk to our clients' websites and data.

  4. Monitoring

    Exploit information appearing online

    Bond & Coyne became aware that exploit information for the critical PHP vulnerabilities was appearing online, and that members of the wider security community had begun validating it.

    Cloudflare has also reported early attack attempts against PHP sites and has deployed protective firewall rules in response.

  5. Preparing

    Planning the patch

    We have started planning to apply the patch as soon as it is released, and will confirm further details as the situation develops.

  6. Notice

    PHP security team confirms a critical security release

    The PHP security team has now officially confirmed the reports circulating earlier this evening, publishing an advance notice of a security release for Wednesday 21 October at 15:00 UK time (14:00 UTC). It fixes two critical vulnerabilities, both rated CVSS v4.0 9.2.

    No details of the vulnerabilities have been published yet, and there's no evidence of them being exploited.

  7. Notice

    Reports of critical PHP vulnerabilities ahead of official announcement

    Bond & Coyne became aware of reports circulating in the security community of two critical PHP vulnerabilities and an upcoming security release to fix them. The information leaked online this afternoon, ahead of any official announcement from the PHP security team, and security researchers have since confirmed the vulnerabilities are genuine.

The original advisory

Notice issued by the PHP security team on

The PHP security team would like to give advance notice of an upcoming security release. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

PHP security team · php.net