PHP vulnerabilities: Websites and Hosting services at IONOS are protected
Two critical flaws in the PHP core are putting websites around the world at risk. IONOS has already applied the official security update on all platforms it operates itself, so customers using these platforms don’t need to take any action.
Yesterday, two critical security vulnerabilities were disclosed in the PHP core that could allow attackers to execute their own code on a website and access customer data. PHP installations worldwide are affected, regardless of the hosting provider. On October 21, 2026, the PHP project released security updates that fix these vulnerabilities.
At IONOS, products that use PHP include Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud, and HiDrive Next. IONOS has already applied the official update on all platforms the company operates itself. Customers don’t need to take any action. Anyone running PHP on their own, for example on a VPS or dedicated server, should install the update with the latest PHP version right away. IONOS publishes the latest information at https://www.ionos-status.com/.
Even before the updates were released, IONOS had implemented additional security measures. Customized PHP configurations and firewall rules are active on the company’s hosting platforms, blocking suspicious requests and reducing the risk. However, only the official update permanently fixes the vulnerabilities.
Watch out for phishing: scammers are increasingly exploiting vulnerabilities like these for phishing, sending fake emails to steal login credentials. IONOS recommends not clicking on links in emails that refer to the PHP vulnerabilities and not entering any login information.