PHP vulnerabilities: websites hosted with IONOS are protected
Two critical flaws in the PHP core are putting websites around the world at risk. IONOS has already applied the official security update on all platforms it operates itself, so customers using these platforms do not need to take any action.
Yesterday, two critical security vulnerabilities were disclosed in the PHP core that could allow attackers to execute their own code on a website and thereby access customer data. PHP installations worldwide are affected, regardless of hosting provider. On 21 October 2026, the PHP project released security updates that close these vulnerabilities.
At IONOS, products that use PHP include Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud and HiDrive Next. IONOS has already applied the official update on all platforms the company operates itself. Customers do not need to take any action. Anyone running PHP themselves, for example on a VPS or Dedicated Server, should install the update with the latest PHP version immediately. IONOS publishes up-to-date information at https://www.ionos-status.de/.
Even before the updates were released, IONOS had put additional protective measures in place. Customised PHP configurations and firewall rules are active on the company’s hosting platforms, blocking suspicious requests and reducing the risk. However, only the official update closes the vulnerabilities permanently.
Beware of phishing: fraudsters are increasingly exploiting vulnerabilities like these for phishing, sending fake emails to obtain login credentials. IONOS advises customers not to click on links in emails that refer to the PHP vulnerabilities and not to enter any login details.