A major security vulnerability in PHP was discovered. As of 22 October 2026, our systems have been patched with the new releases.
Status as of 2026-10-21 11:00:00 CEST
21 October 2026 at 16:00 CEST the PHP team will release new versions, but exploitation attempts are already happening.
There is no mitigation, all PHP sites that use “multi-part” file uploads are vulnerable. Only bringing sites off-line will help.
We know that Wordpress sites are affected. So we are taking down all Wordpress sites that we host until an updated PHP version is released.
Update 2026-10-21 13:17:00 CEST
We are still waiting for new versions of PHP, mean while we:
- Stopped all wordpress sites.
- Blocked multi-part uploads to all websites (this is the attack vector)
Update 2026-10-23 14:40:00 CEST
In the past few days, we checked our webservers that run PHP, and patched them when new packages were available.
Most websites are online again. Thanks to Ubuntu ESM some websites running on older PHP versions have been patched as well. If you notice your website is still offline, feel free to contact us.
update 2026-10-27
telgids.science.ru.nl is now back online.