Update October 21, 2026 @ 12:15 PM

On October 20, it was announced that there are two critical security vulnerabilities in PHP. PHP is the programming language that powers WordPress, WooCommerce, and many other websites. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619, also known as "PHP2Shell") are classified as having the highest severity level. An attacker could potentially take over a web server via the internet without needing to log in. Details regarding the vulnerabilities were leaked before a fix was available, and there are now reports that they are being actively exploited.

What have we done?

To protect our clients' websites and data, we have disabled PHP on our hosting servers today. As a result, websites that rely on PHP are temporarily unavailable. We have made this choice deliberately: according to security researchers, the temporary workarounds suggested online do not provide complete protection. While having a website offline for a short time is inconvenient, a hacked website is far worse.

Webflow websites remain operational

Websites we have built in Webflow do not run on PHP and will remain online as usual. Do you have a Webflow site with us? Then you don't need to do anything. If a Webflow website is integrated with another platform that does use PHP, it is likely that these will also be offline.

When will websites be back online?

The PHP team is releasing a security update today at 4:00 PM (CET). As soon as it is available, we will install and test the update before bringing the websites back online. We will keep this post updated.

Do you need to do anything?

If your website is hosted with us, we will handle everything. If you have a PHP website hosted elsewhere, please contact your provider and ask if they will be installing the update today. Do you have any questions?Feel free to contact us.

‍

Update October 21, 2026 @ 4:00 PM

More information will follow regarding the release of the (expected) update around 4:00 PM ...