Websites and hosting at IONOS are protected. Two critical vulnerabilities in the PHP core were disclosed yesterday. Attackers could exploit them to run their own code on a website and gain access to customer data. PHP installations worldwide are affected, regardless of hosting provider. On October 21, 2026, the PHP project released security updates to fix these vulnerabilities.
At IONOS, PHP is used by services including Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud and HiDrive Next. IONOS already rolled out the official updates across all platforms it operates itself. Customers do not need to take any action. Anyone running PHP themselves—for example, on a VPS or dedicated server—should install the update for the [latest PHP version](http://www.php.net) immediately.
IONOS implemented additional protective measures before the updates were released. Its hosting platforms use customized PHP configurations and active firewall rules to block suspicious requests and reduce risk. However, only the official update can permanently fix the vulnerabilities. Beware of phishing: Fraudsters often exploit vulnerabilities like these in phishing attempts, sending fake emails to obtain login credentials. IONOS advises customers not to click links in emails referring to the PHP vulnerabilities or enter their login details.
The Website Builder and IONOS Control Panel systems are stable and all services are functioning normally again.
Posted Oct 22, 2026 - 03:13 EDT
Update
We are still working on resolving the technical issue. Thank you for your patience.
Posted Oct 22, 2026 - 00:51 EDT
Update
We are continuing to work on restoring these features (services).
Posted Oct 21, 2026 - 17:03 EDT
Update
We will post an update as soon as new information becomes available.
Posted Oct 21, 2026 - 11:52 EDT
Identified
What’s happening? A critical security gap has been found in PHP, a technology used by many websites and web applications worldwide. The PHP developers and national security authorities have issued urgent warnings and recommend installing the security update immediately, as attacks are expected within hours. To protect you and your data, we’re installing the security update across our systems right now. We expect to be finished within the next 24 hours.
What does this mean for you? While we update our systems, some websites and services may be slow or briefly unavailable. We’re taking this step to protect you.
If you run a self-managed application, for example on a VPS or Bare Metal Server, please install the PHP security update as soon as possible to protect your systems. You can find more information here: https://www.php.net/
Thank you for your patience and understanding.
Posted Oct 21, 2026 - 11:25 EDT
This incident affected: Hosting (Web Hosting, Web Hosting Windows, Wordpress Hosting, Wordpress Pro), Website Builder (MyWebsite (ordered before 09/06/2017), MyWebsite NOW), and IONOS (IONOS Control Panel).