A major security vulnerability in PHP was discovered.

Today at 16:00 CEST the PHP team will release new versions, but active exploitation is happening.

There is no mitigation, all PHP sites that use “multi-part” file uploads are vulnerable. Only bringing sites off-line will help.

We know that Wordpress sites are affected. So we are taking down all Wordpress sites that we host until an updated PHP version is released.

Update 2036-10-21 13:17:00 CET

We are still waiting for new versions of PHP, mean while we:

• Stopped all wordpress sites.
• Blocked multi-part uploads to all websites (this is the attack vector)