What is going on?
Two critical security vulnerabilities have been found in PHP itself, CVE-2026-109618 and CVE-2026-109619. The PHP security team rates both with a CVSS score of 9.2. These vulnerabilities allow an attacker to run code on a server without logging in. Details about the vulnerabilities leaked before a fix was available. No exploitation has been reported so far, but it is expected as soon as the update is released.
PHP will release the update today at 14:00 UTC (16:00 CEST). We will install it on all our systems right after.
What are we doing?
From 11:15, the client area, the game panel and the VPS panel will be temporarily offline. Webmail (Roundcube) and phpMyAdmin will also be temporarily unavailable. After 14:00 UTC we will update PHP on all web hosting servers.
What does this mean for you?
Your game servers, VPSes and websites keep running as normal. You just can't manage them during the maintenance. While we update the web hosting servers, your website may be unavailable for a very short time. Email keeps working through your mail app or phone, only webmail is unavailable for now. Payments made during this period may take a little longer to process.
Is your website running on PHP 8.1 or older?
PHP will not release an update for these versions, so your website will remain vulnerable. Please switch your website to PHP 8.2 or newer as soon as possible. You can do this yourself in DirectAdmin under [menu path]. Check afterwards that your website still works properly, as older plugins or themes sometimes don't work with a newer PHP version.
We will update this page as soon as anything changes.
