HostPressStatus

All systems operational

Data centers

Operational
  • Data center SaarwellingenOperational
  • Data center NurembergOperational
  • Data center FrankfurtOperational
  • Data center LosheimOperational

Support

Operational
  • PhoneOperational
  • ChatOperational
  • FAQ centerOperational
  • HostPress websiteOperational
  • HostPress customer centerOperational

Servers

Operational
  • Backup serverOperational
  • Email protectionOperational

Information

  • Current information: Critical security vulnerabilities in PHP (PHP2Shell)Info#1

    Last updated 22 Oct 2026, 13:01 (CEST)

    UpdateCurrent

    Security updates for PHP 7.4 to 8.1 – we are staying with PHP 8.2 or newer

    Plesk has now also released security updates for the older versions PHP 7.4, 8.0 and 8.1 (7.4.33, 8.0.30 and 8.1.34, each built on 21 Oct 2026).

    We will nevertheless not switch websites back automatically: PHP versions below 8.2 have reached end of life (EOL) and no longer officially receive security updates. For future vulnerabilities, there will most likely be no patches for these versions.

    Please keep checking that your website works properly with PHP 8.2 or newer. How to spot errors and find their cause (German): Nach dem PHP-Update: So erkennst du Probleme mit deiner WordPress-Website

    You absolutely cannot do without PHP 8.1 or older? Please contact our support by email at support@hostpress.de or via live chat in the customer center. We will put you on a waiting list and, if required, manually switch your website back to one of the patched older PHP versions.

    All details (German): Current information on PHP2Shell

    UpdateCurrent

    PHP Security Vulnerabilities: All Servers Updated, Older PHP Versions Migrated

    The secured PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 have been deployed on all Plesk servers.

    We migrated websites that were still using PHP 8.1 or older to PHP 8.2 or higher overnight. So far, we have not been able to deploy the announced security updates for PHP versions below 8.2 in a verified form. Given the severity of these security vulnerabilities, we had to take this action to protect all websites on our servers. We ask for your understanding.

    We have documented the original settings of each website. As soon as Plesk provides a way to secure PHP versions below 8.2, we will install these updates. After that, you will be able to switch your website back to its previous version.

    What you should do now: If your website was previously running on PHP 8.1 or older, please thoroughly check it now, including contact forms, the WordPress login, and the checkout process for online shops. If any errors occur, they are usually caused by outdated plugins or themes. Please update them or contact your developer or agency. Downgrading to an older PHP version is currently not possible.

    We also recommend updating your WordPress administrator passwords and WordPress security keys (salts): https://docs.hostpress.de/article/wordpress-sicherheitsschluessel-salts-erneuern/

    Our firewall (Imunify360) continues to block known attack patterns and is constantly updated.

    Initial report

    What happened?

    On 21 October 2026, the PHP project published two critical security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619, also known as “PHP2Shell”). All websites based on PHP are affected, including WordPress and WooCommerce. The vulnerabilities are in PHP itself, not in WordPress, themes or plugins.

    How is your website at HostPress affected?

    The most serious known attack variant requires a PHP operating mode (Apache module mod_php) that we generally do not use at HostPress. Our websites run via PHP-FPM. For this operating mode the risk is lower, but not ruled out. We are treating the incident as a top priority.
    If your website runs on a Plesk server in the former “WP-Projects” environment, please use the instructions below to check which PHP version you are using and whether it is run as an “FPM application”.

    What we have already done

    On all servers we have disabled the PHP feature “Session Upload Progress” and restarted all PHP processes. In doing so we are following the recommendation of the PHP project and blocking the attack path confirmed for PHP-FPM.
    Our Web Application Firewall (Imunify360) filters known attack patterns and variants of the publicly available attack tool before the request reaches your website. The rules are updated automatically on an ongoing basis. IP addresses that search for or exploit these vulnerabilities are shown a CAPTCHA.
    Both are interim measures that significantly reduce the risk but do not replace the PHP update.

    Status of the PHP updates

    Because the update servers of the major software vendors are currently under very heavy load, updates are taking unusually long.

    • PHP 8.2 to 8.5: The secured versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are currently being installed or have already been installed on many servers.

    Current status 21 Oct 2026 – 23:00: 95% of all servers are on the current PHP versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12

    • PHP 7.4 to 8.1: Our software vendor Plesk also provides security updates for these versions. They are currently being installed, or we will install them as soon as they can be retrieved from the update servers.
    • PHP 7.3 and older: There are no security updates for these versions.

    Do you want to know which PHP version is currently active on your website?

    This is how you can reliably check your current PHP version in the WordPress admin area:

    1. Go to “Tools” → “Site Health” in the WordPress backend
    2. Switch to the “Info” tab at the top
    3. Scroll down to “Server” and expand the toggle
    4. The table now shows the “PHP version”

    Recommendation from CERT-EU

    The Computer Emergency Response Team for the EU institutions (CERT-EU) recommends updating affected systems immediately. Where this is not possible, publicly accessible applications should be disconnected from the internet until an update has been installed.

    What you should do

    • PHP 8.3 or newer: No action required. We will install the updates for you.
    • PHP 8.2: No urgent action required, we will install the security updates. PHP 8.2 will no longer receive security updates from 31 December 2026. We recommend switching to PHP 8.3 or newer in the coming weeks.
    • PHP 7.4, 8.0 or 8.1: We will install the emergency patches. Even so, we strongly recommend switching to PHP 8.3 or newer. These versions are no longer regularly maintained and are not expected to receive updates for future security vulnerabilities.
    • PHP 7.3 or older: Please switch your website to PHP 8.3 or newer yourself immediately.

    For websites running PHP 8.1 or older we are planning further steps. We will inform affected customers separately.

    How to switch the PHP version

    Instructions: https://docs.hostpress.de/article/php-einstellungen-in-plesk/
    You can reach the Plesk interface after logging in to our customer center via the “Control Panel Login” button.
    Before the switch: update WordPress, all plugins and your theme, and create a backup. After the switch: check your website thoroughly. If something does not work as usual, you can switch the PHP version back in Plesk.
    You are responsible for the compatibility of your website with a new PHP version. Errors after a version change are usually caused by outdated plugins or themes. We cannot fix these as part of our hosting support. In this case, please contact your developer or agency.

    Frequently asked questions

    Why is the status page not reachable?

    The server of our status page is also receiving the PHP security updates right now. Because the update servers of the major software vendors are currently under very heavy load, updates are taking unusually long. The status page will be reachable again as soon as the update on this server is complete. Until then, we will keep you informed here. This is maintenance, not an incident.

    I suddenly see a CAPTCHA when I open my website.

    Our firewall temporarily shows a CAPTCHA to IP addresses that have attracted attention through suspicious requests. After solving it you can use the website normally. If the CAPTCHA appears repeatedly, for example on your own server or an external service that accesses your website, please contact our support.

    A file upload or form has stopped working recently.

    The firewall is currently also blocking suspicious upload requests. In rare cases this can affect legitimate uploads. Please contact our support and tell us the domain, the time and the affected function.

    I use an upload progress bar in my own application.

    The disabled feature “Session Upload Progress” is not used by WordPress itself. If you run into problems in your own application, please contact our support.

    I also have websites with other providers.

    Please check there as well whether the PHP updates have been installed.

    Can you check whether the vulnerability was exploited on my website?

    Unfortunately, exploitation of these vulnerabilities cannot be proven or ruled out with certainty, not even by analysing log files. We cannot perform an individual forensic examination of individual websites as part of our hosting support.
    We do this automatically for all websites: Our firewall (Imunify360) blocks known attack patterns, and our malware scanner continuously checks the files on our servers for malicious code. If anything is found, we will contact you.
    You can check the following yourself:

    • Are there administrators in WordPress under “Users” that you do not know?
    • Have plugins or themes been installed that you do not know?
    • Does your website redirect to other sites, or does it show content that is not yours?
    • Have you received unusual emails from your domain or warnings from Google?

    Independently of this, we recommend that you renew the passwords of your WordPress administrators and the WordPress security keys (salts) as soon as your PHP version has been updated.
    If you have a specific suspicion or any of these points apply, contact your developer, your agency or a specialist service provider for cleaning up hacked websites. We support you with the following guides: providing log files or restoring a backup.

    If you have any questions, you can reach our support as usual via the customer center.

Incidents

There are no incidents right now.