Two critical vulnerabilities have been discovered in PHP, the most widely used programming language on the Internet. All versions starting at PHP 5 are affected.
As soon as a patch becomes available, we will deploy it to all servers. Based on current information, this is expected to be from 4:00 PM on Wednesday, 21 October onwards.
Today's patch will only be available for PHP 8.2 and later versions.
A patch for older versions may become available at a later stage, but there is currently no certainty regarding this.
As a precautionary measure, we have temporarily disabled some servers hosting our own websites and applications.
You can check whether your websites are running PHP 8.2 or higher. If so, your websites will be protected as soon as the patch becomes available and has been applied.
Updates
15:55 - The patch is now available for PHP8.2 and higher. We are starting to deploy it to the first servers. It may take up to several hours for all servers to be patched.
16:30 - There are also patches available for older PHP versions (older than 8.2) for supported operating systems (Ubuntu 22.04 and later). We are currently deploying these patches to servers.
16:50 - A number of servers have already been patched.
17:30 - The rollout of the patch is moving slower than expected due to a slow download speed from the servers that host the images.
18:10 - The rollout of the patches is progressing. A large number of cloud servers is now patched, as well as the first shared hosting servers.
19:00 - All shared hosting servers from apache19 to apache36 are now patched.
20:00 - Most servers where a recent operating system is installed (Ubuntu 22.04 and more recent) are now patched. We are still performing test to ensure that the patch applied correctly.
21:00 - All servers with Ubuntu 22.04 and more recent are now patched and tested, except for a few servers that use Plesk-control panel. The updates of the Plesk servers take a long time due to a slow download speed from the servers that host the Plesk updates. We are working hard to get the Plesk updates deployed as soon as possible.
23:00 - For now, alle servers have all patches thar are available. The next step is that we will contact all customers with servers that cannot be patched.
Frequently Asked Questions
I see that some companies are shutting down their servers. Should I shut down my server as well?
If your website or applications use PHP and process personal, sensitive, confidential, or financial data, it may be advisable, as a precautionary measure, to shut down the server or block HTTP/HTTPS access at the firewall level until a patch becomes available.
Will all servers be patched?
Yes. All servers on which we have installed PHP will be patched as soon as a patch becomes available. It may take a few hours for all servers to be patched.
For PHP 8.2 and later, the patch is expected to be available from 4:00 PM on Wednesday, 21 October, and will be deployed immediately thereafter.
For other PHP versions, we are closely monitoring the situation and will provide updates as more information becomes available.
What can I do myself?
The first step is to check whether your website is running PHP 8.2 or later. If not, you should consider upgrading to a newer PHP version if your website or web application supports it.
Doing so will allow you to benefit from the security patch as soon as it becomes available and is deployed.
How do I know if I am using a secure PHP version?
If the PHP version of your website is PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 or PHP 8.2.35 then your website is protected against these two vulnerabilities.