All Systems Operational

dataforest Network Operational
Edge Network (affects all locations) Operational
DDoS Protection (affects all locations) Operational
Dedicated Servers (EQX-FR4 & DRT-FRA8) Operational
Datacenter MC-FRA01 Operational
Datacenter Core Routing & Switching Operational
Ceph Cluster Operational
Virtual Servers Operational
Dedicated Servers Operational
Plesk Web Hosting Operational
TeamSpeak3 Servers Operational
Network Storage Operational
Facilites Operational
Datacenter FC-FRA4 Operational
Datacenter Core Routing & Switching Operational
Dedicated Servers Operational
Facilites Operational
General Services Operational
Avoro CP & Support Operational
PHP-Friends CRM & Support Operational
Hotline Operational
Dedicated Control Panel Operational
IPMI VPN Operational
DDoS Manager Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance

Nov 5, 2026

No incidents reported today.

Nov 4, 2026

No incidents reported.

Nov 3, 2026

No incidents reported.

Nov 2, 2026

Resolved - Since we do not receive a lot of support requests about the PHP vulnerabilities anymore, we are closing this incident. Our advisory remains unchanged; we will permanently disable all PHP versions up to and including 8.2 on our systems in early 2027.
Nov 2, 20:19 CET
Update - Legacy PHP-Friends virtual server control panel
• ISO mounting restored on 23.10.2026 at 19:00 CEST
• VNC console restored on 23.10.2026 at 23:45 CEST
• OS reinstallation restored on 24.10.2026 at 01:00 CEST

Webhosting (summary / reminder)
• Websites using PHP versions older than 8.2 were switched to PHP 8.5. If your application does not support PHP 8.5, you can choose PHP 8.4 or 8.3. PHP 8.2 is still available but not recommended, as it reaches its official end of life on 31.12.2026.

Managed Servers (summary / reminder)
• PHP versions older than 7.4 have been permanently disabled. Websites still using them remain offline until they are switched to a newer PHP version.
• PHP 7.4, 8.0 and 8.1 have received backported security fixes and remain usable, but we strongly advise against using them. If another critical vulnerability affects these versions, which we expect, we will disable them immediately and permanently.
• Our advice remains unchanged: switch to a supported PHP version now, update outdated software and replace it where necessary.
• We will permanently disable all PHP versions up to and including 8.2 on our systems in early 2027. This temporary exception exists only to allow the necessary migrations with minimal downtime, so please start migrating now.

Oct 24, 01:49 CEST
Update - As with VNC access, operating system reinstallations and ISO mounting are currently unavailable in the legacy PHP-Friends virtual server control panel. We are working to restore all three functions.
Oct 23, 15:42 CEST
Monitoring - The control panel for legacy PHP-Friends virtual servers (https://web7.php-friends.de) is back online.

In addition to applying the vendor's security updates, we have placed the panel behind our own Web Application Firewall (WAF) within our modernized infrastructure – a security measure that has become standard for every new platform we bring online. Given the sensitive data handled by this panel, we decided to implement this additional layer of protection before restoring public access.

VNC functionality will be restored tomorrow.

Oct 23, 01:42 CEST
Update - • The security update for the Plesk control panel became available an hour ago. We immediately verified and deployed it. Access to the Plesk control panels has been restored.
• Some non-critical or legacy customer portals may remain restricted. Our priority remains restoring availability of customer websites. We are paying particular attention to individual issues following the updates. If anything is not working as expected, please report it immediately to hi@dataforest.net.

Oct 22, 02:05 CEST
Update - • Over the past few hours, we have verified and deployed exceptional security backports for PHP 7.4, 8.0 and 8.1 on our managed servers. These backports were made available separately, after the regular security updates for supported PHP versions, as a one-time exception for these end-of-life versions. Websites using these versions have been reactivated.
• Following extensive internal discussion, we have made this temporary exception solely (for managed servers) because customers currently cannot access Plesk to change their PHP version themselves. Access to the Plesk control panels remains disabled.
• Our instruction remains unchanged: switch to a supported PHP version immediately, update outdated software, and replace it where necessary. PHP 8.5 should be your migration target. Please notice: Active bugfix support for PHP 8.2 ended on 31.12.2024, it receives security updates only and will reach its official end of life on 31.12.2026.
• Given the current threat landscape, including AI-assisted vulnerability research, we expect further serious security vulnerabilities to be discovered in outdated software. These exceptional backports do not restore ongoing security support for the affected versions!
• If another security vulnerability affecting these outdated PHP versions becomes public, we will disable them again immediately and permanently. This also applies if the current security fixes are found to be incomplete.
• Regardless of further developments, we will permanently disable all PHP versions up to and including 8.2 on our systems in early 2027. Please begin your migration to supported PHP versions now. This temporary exception serves only to facilitate the necessary migrations and minimise downtime.

Oct 22, 01:14 CEST
Update - • We have temporarily disabled access to the Plesk control panels again. Further verification showed that the separate PHP runtime used by Plesk itself still requires an additional vendor security update.
• This restriction affects Plesk access only. The websites restored earlier remain online.
• We understand that you need panel access to manage your services, particularly to make the PHP version changes described in our earlier updates. We are sorry for the additional disruption. We currently have no ETA for restoring access. The panels will remain unavailable until we can apply and verify the required security update.
• Managed Servers: You do not need panel access for this. Our support team (hi@dataforest.net) can still switch all domains on your server that use outdated PHP versions to PHP 8.2, 8.3, 8.4 or 8.5.

Oct 21, 22:34 CEST
Update - • All web hosting and managed servers were brought back online between 18:15 and 18:30 CEST.
• Managed Servers: As previously explained, we have not changed any PHP versions on managed servers. If your website still uses an unsupported PHP version, please select a supported version in Plesk. Our support team can also switch all domains on your server that still use outdated PHP versions to PHP 8.2, 8.3, 8.4 or 8.5. Websites already using a supported PHP version should be accessible again. If this is not the case, or if you are experiencing other unexpected issues, please contact our support team.
• Webhosting: If your application is compatible with PHP 8.2 or later but you are still experiencing issues, please contact our support team.
• For all other cases related to this incident, including questions already answered in this post, please refrain from contacting our support team. This helps prevent support overload and keeps our team available for customers who need individual assistance.
• Updates for managed mailcow instances became available a few minutes ago, and we are already deploying them. Brief service interruptions may occur during the rollout.

Oct 21, 20:13 CEST
Update - We have temporarily disabled some payment methods in the Avoro customer area because external licensing and payment services are unavailable for the same reasons. These outages are beyond our control. We will reactivate the affected payment methods as soon as the external services are restored.
Oct 21, 18:37 CEST
Update - • All managed server and web hosting systems have been patched and updated. The rollout took some time due to overloaded download mirrors.
• The majority of our own infrastructure, including our customer portals, is back online. Some non-critical or legacy services are not.
• Plesk panels are available again, too.
• We have decided to take a different approach depending on the product:
• Managed Servers: Websites configured to use unsupported PHP versions will not be automatically switched to PHP 8.5 to avoid compatibility issues. Instead, unsupported PHP versions will remain disabled, and affected websites will display an error page with HTTP status code 503 (Service Unavailable). Customers must manually select a supported PHP version in Plesk.
• Webhosting: Websites configured to use unsupported PHP versions have been switched to PHP 8.5. Supported PHP versions down to 8.2 remain available for selection.
• We have already started bringing our web hosting and managed servers back online. All websites running PHP 8.2 or later should be available again within the next 15-60 minutes.
• The PHP team has provided minimal security backports for the end-of-life (EOL) versions PHP 7.4, 8.0 and 8.1 as a one-time exception. We are monitoring the situation closely, but please do not rely on these becoming available for our systems, especially since these are not yet available through Plesk or the relevant Linux distributions. Furthermore, these PHP versions had already reached end of life before and should no longer have been in use. For websites still configured to use an unsupported PHP version, switching to a supported version is currently the only available way to restore service on our systems.

Oct 21, 18:22 CEST
Update - First exploitations are seen in the wild. We have shut down all PHP services on managed servers and web hosting servers. We understand that this is a drastic measure. It is necessary to protect your data.

We are deploying PHP updates for supported versions across our infrastructure which were released a few minutes ago. Before bringing back online the systems, we will disable unsupported PHP versions by switching the affected websites to PHP 8.5. You will then be able to switch back as far as PHP 8.2, but you will no longer be able to select an unsupported version.

If you are running PHP applications on an unmanaged server, shut them down now until you have updated.

Emergency support is available via hi@dataforest.net.

Oct 21, 15:59 CEST
Update - • Updated: Title and sources
• Specified: dataforest's own infrastructure
• Please refrain from individual requests to our support about the situation. You find our suggested actions in this post. Migrate your websites to new (supported) PHP versions as described below or simply shut them down until PHP updates are released as a precautionary measure. The first governments already did so with their websites.
• Due to the urgency of the situation, we have sent out a newsletter to all customers.

Oct 21, 15:32 CEST
Identified - We would like to inform you about two critical security vulnerabilities in the PHP scripting language. Please read this post carefully and in full. We ask for your understanding that information is still limited, the situation may change at any time, and this post will therefore be updated continuously. Please subscribe to our status page to receive updates and check this post regularly.

Summary

According to current assessments, these vulnerabilities allow remote code execution in all PHP versions from version 5 onwards. In simple terms, attackers can exploit them to execute arbitrary code in the context of the affected PHP application. The application only needs to be accessible over the internet. With nearly 70% of all websites using PHP, the potential impact is substantial. Of particular concern is that only PHP 8.5, 8.4, 8.3 and 8.2 still receive security updates. Websites running older PHP versions that are no longer supported should therefore be migrated to a current version immediately.

We do not want to cause panic: our specialists convened immediately, developed an action plan and have already begun implementing it. All departments are ready to respond. Nevertheless, website operators and server administrators need to remain alert and act quickly. Further information on our response and our recommendations is provided below.

Details of the vulnerabilities were originally scheduled to be published on 22.10.2026 at 17:00 CEST, after the corresponding security updates had been made available. However, information was leaked by unknown parties a few hours ago. The PHP security team has therefore announced that the release has been brought forward and is imminent.

Managed servers and web hosting

We have begun disabling outdated PHP handlers. This means that only PHP versions that still receive security updates can be selected. We strongly urge you to switch your websites to one of these versions immediately. Where necessary, isolate outdated applications that cannot be migrated immediately from the internet, then migrate them to newer software without leaving them exposed.

Please note: As soon as we become aware of a publicly available and therefore actively exploited exploit, we will immediately disable unsupported PHP versions across all managed servers and web hosting servers by switching the affected websites to PHP 8.5. You would then be able to switch back as far as PHP 8.2, but would no longer be able to select an unsupported version. We understand that this would be a drastic step, but we must consider it to protect your data and that of your customers.

For supported PHP versions, we expect updates over the coming days and will install them as soon as they become available. At present, we cannot predict whether exploits will become public and be used before then. Please assess whether you wish to isolate your PHP-powered websites from the internet until updates are available.

Unmanaged (self-managed) servers

Our recommendation: migrate outdated PHP applications to a supported PHP version immediately. Update your PHP installation as soon as updates become available for your system. If your operating system no longer receives updates, upgrade it immediately. Isolate applications from the internet if they cannot be migrated promptly.

Outlook

Once sufficient technical details are available, we will also assess whether the attack vectors can be mitigated at the web server level (for example, through a Web Application Firewall enabled by default on Plesk servers) or by other means. Until we know more, however, we must assume that running a supported PHP version and installing the corresponding updates is the only option.

dataforest's own infrastructure

- We have decided to shut down particularly critical systems as a precaution until the situation becomes clearer – especially those that handle customer data or have extensive internal permissions. This may temporarily limit certain product and server management functions. During this time, you can ask our support team at hi@dataforest.net to carry out the corresponding actions for you at any time.

- Over the coming hours and days, we reserve the right to perform maintenance on any of our customer portals, temporarily restrict access to them, or shut down legacy sites permanently without further notice.

Sources

https://www.php.net/archive/2026.php
https://cert.europa.eu/publications/security-advisories/2026-018/
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
https://www.heise.de/en/news/Critical-PHP-updates-on-Oct-21-fix-code-injection-vulnerabilities-11495177.html
https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2026/261021_PHP-kritische-Schwachstelle.html
https://www.tagesschau.de/wirtschaft/technologie/it-sicherheit-php-luecke-100.html

Oct 21, 03:55 CEST

Nov 1, 2026

No incidents reported.

Oct 31, 2026

No incidents reported.

Oct 30, 2026

No incidents reported.

Oct 29, 2026

No incidents reported.

Oct 28, 2026

No incidents reported.

Oct 27, 2026

Resolved - This incident has been resolved.
Oct 27, 11:39 CET
Monitoring - A hardware issue led to the DDoS Manager's outage which is now resolved.
Oct 27, 11:24 CET
Identified - The issue has been identified and a fix is being implemented.
Oct 27, 10:34 CET

Oct 26, 2026

No incidents reported.

Oct 25, 2026

No incidents reported.

Oct 24, 2026

Oct 23, 2026

Resolved - This incident has been resolved.
Oct 23, 22:16 CEST
Monitoring - The Avoro VPS node vps-008 has crashed and was rebooted 5 minutes ago. VMs are already back online.
Oct 23, 16:39 CEST
Completed - The scheduled maintenance has been completed.
Oct 23, 17:00 CEST
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 12, 08:00 CEST
Scheduled - Start: 12.10.2026, 08:00 CEST
End: 23.10.2026, 17:00 CEST

Power infrastructure upgrades will be carried out at FC-FRA4 across two phases. The work is intended to improve redundancy and operational stability while providing additional capacity for future growth. No downtime is planned for connected systems.

From 12.10.2026 to 16.10.2026, the power feeds of distribution systems A and B will be modified to improve selectivity and operational safety. The work will be performed sequentially, with only one power path being worked on at a time. During each respective phase, the affected power path will be supplied by the datacenter's diesel generator system, while UPS protection remains active throughout generator operation.

As this phase involves switching and work on the active power infrastructure, a small residual risk remains. In the (unlikely and unexpected) event of a disruption affecting the respective path, some rack feeds will become unavailable.

From 19.10.2026 to 23.10.2026, additional electrical supply lines will be installed, tested and commissioned to expand the site's power infrastructure and provide additional capacity.

We will provide an update should any unexpected impact occur.

Sep 19, 16:15 CEST

Oct 22, 2026

Resolved - No more issues were observed. Monitoring improvements have already been implemented.
Oct 22, 19:15 CEST
Monitoring - Over the past few hours, we have observed increased disk latency in our Ceph cluster, affecting storage performance in both the dataforest cloud and the Avoro cluster. We have identified a faulty disk and taken it out of service. If you continue to observe unusual disk latency or performance issues, please report them to hi@dataforest.net.

We are not aware of any resulting disruptions to production services or outages. However, customers may have noticed the increased latency in their own monitoring, so we are sharing this update to explain what happened. We will also improve our monitoring to detect similar issues sooner.

Oct 22, 13:15 CEST