Update - • We have temporarily disabled access to the Plesk control panels again. Further verification showed that the separate PHP runtime used by Plesk itself still requires an additional vendor security update.
• This restriction affects Plesk access only. The websites restored earlier remain online.
• We understand that you need panel access to manage your services, particularly to make the PHP version changes described in our earlier updates. We are sorry for the additional disruption. We currently have no ETA for restoring access. The panels will remain unavailable until we can apply and verify the required security update.
• Managed Servers: You do not need panel access for this. Our support team (hi@dataforest.net) can still switch all domains on your server that use outdated PHP versions to PHP 8.2, 8.3, 8.4 or 8.5.
Oct 21, 2026 - 22:34 CEST
• This restriction affects Plesk access only. The websites restored earlier remain online.
• We understand that you need panel access to manage your services, particularly to make the PHP version changes described in our earlier updates. We are sorry for the additional disruption. We currently have no ETA for restoring access. The panels will remain unavailable until we can apply and verify the required security update.
• Managed Servers: You do not need panel access for this. Our support team (hi@dataforest.net) can still switch all domains on your server that use outdated PHP versions to PHP 8.2, 8.3, 8.4 or 8.5.
Oct 21, 2026 - 22:34 CEST
Update - • All web hosting and managed servers were brought back online between 18:15 and 18:30 CEST.
• Managed Servers: As previously explained, we have not changed any PHP versions on managed servers. If your website still uses an unsupported PHP version, please select a supported version in Plesk. Our support team can also switch all domains on your server that still use outdated PHP versions to PHP 8.2, 8.3, 8.4 or 8.5. Websites already using a supported PHP version should be accessible again. If this is not the case, or if you are experiencing other unexpected issues, please contact our support team.
• Webhosting: If your application is compatible with PHP 8.2 or later but you are still experiencing issues, please contact our support team.
• For all other cases related to this incident, including questions already answered in this post, please refrain from contacting our support team. This helps prevent support overload and keeps our team available for customers who need individual assistance.
• Updates for managed mailcow instances became available a few minutes ago, and we are already deploying them. Brief service interruptions may occur during the rollout.
Oct 21, 2026 - 20:13 CEST
• Managed Servers: As previously explained, we have not changed any PHP versions on managed servers. If your website still uses an unsupported PHP version, please select a supported version in Plesk. Our support team can also switch all domains on your server that still use outdated PHP versions to PHP 8.2, 8.3, 8.4 or 8.5. Websites already using a supported PHP version should be accessible again. If this is not the case, or if you are experiencing other unexpected issues, please contact our support team.
• Webhosting: If your application is compatible with PHP 8.2 or later but you are still experiencing issues, please contact our support team.
• For all other cases related to this incident, including questions already answered in this post, please refrain from contacting our support team. This helps prevent support overload and keeps our team available for customers who need individual assistance.
• Updates for managed mailcow instances became available a few minutes ago, and we are already deploying them. Brief service interruptions may occur during the rollout.
Oct 21, 2026 - 20:13 CEST
Update - We have temporarily disabled some payment methods in the Avoro customer area because external licensing and payment services are unavailable for the same reasons. These outages are beyond our control. We will reactivate the affected payment methods as soon as the external services are restored.
Oct 21, 2026 - 18:37 CEST
Oct 21, 2026 - 18:37 CEST
Update - • All managed server and web hosting systems have been patched and updated. The rollout took some time due to overloaded download mirrors.
• The majority of our own infrastructure, including our customer portals, is back online. Some non-critical or legacy services are not.
• Plesk panels are available again, too.
• We have decided to take a different approach depending on the product:
• Managed Servers: Websites configured to use unsupported PHP versions will not be automatically switched to PHP 8.5 to avoid compatibility issues. Instead, unsupported PHP versions will remain disabled, and affected websites will display an error page with HTTP status code 503 (Service Unavailable). Customers must manually select a supported PHP version in Plesk.
• Webhosting: Websites configured to use unsupported PHP versions have been switched to PHP 8.5. Supported PHP versions down to 8.2 remain available for selection.
• We have already started bringing our web hosting and managed servers back online. All websites running PHP 8.2 or later should be available again within the next 15-60 minutes.
• The PHP team has provided minimal security backports for the end-of-life (EOL) versions PHP 7.4, 8.0 and 8.1 as a one-time exception. We are monitoring the situation closely, but please do not rely on these becoming available for our systems, especially since these are not yet available through Plesk or the relevant Linux distributions. Furthermore, these PHP versions had already reached end of life before and should no longer have been in use. For websites still configured to use an unsupported PHP version, switching to a supported version is currently the only available way to restore service on our systems.
Oct 21, 2026 - 18:22 CEST
• The majority of our own infrastructure, including our customer portals, is back online. Some non-critical or legacy services are not.
• Plesk panels are available again, too.
• We have decided to take a different approach depending on the product:
• Managed Servers: Websites configured to use unsupported PHP versions will not be automatically switched to PHP 8.5 to avoid compatibility issues. Instead, unsupported PHP versions will remain disabled, and affected websites will display an error page with HTTP status code 503 (Service Unavailable). Customers must manually select a supported PHP version in Plesk.
• Webhosting: Websites configured to use unsupported PHP versions have been switched to PHP 8.5. Supported PHP versions down to 8.2 remain available for selection.
• We have already started bringing our web hosting and managed servers back online. All websites running PHP 8.2 or later should be available again within the next 15-60 minutes.
• The PHP team has provided minimal security backports for the end-of-life (EOL) versions PHP 7.4, 8.0 and 8.1 as a one-time exception. We are monitoring the situation closely, but please do not rely on these becoming available for our systems, especially since these are not yet available through Plesk or the relevant Linux distributions. Furthermore, these PHP versions had already reached end of life before and should no longer have been in use. For websites still configured to use an unsupported PHP version, switching to a supported version is currently the only available way to restore service on our systems.
Oct 21, 2026 - 18:22 CEST
Update - First exploitations are seen in the wild. We have shut down all PHP services on managed servers and web hosting servers. We understand that this is a drastic measure. It is necessary to protect your data.
We are deploying PHP updates for supported versions across our infrastructure which were released a few minutes ago. Before bringing back online the systems, we will disable unsupported PHP versions by switching the affected websites to PHP 8.5. You will then be able to switch back as far as PHP 8.2, but you will no longer be able to select an unsupported version.
If you are running PHP applications on an unmanaged server, shut them down now until you have updated.
Emergency support is available via hi@dataforest.net.
Oct 21, 2026 - 15:59 CEST
We are deploying PHP updates for supported versions across our infrastructure which were released a few minutes ago. Before bringing back online the systems, we will disable unsupported PHP versions by switching the affected websites to PHP 8.5. You will then be able to switch back as far as PHP 8.2, but you will no longer be able to select an unsupported version.
If you are running PHP applications on an unmanaged server, shut them down now until you have updated.
Emergency support is available via hi@dataforest.net.
Oct 21, 2026 - 15:59 CEST
Update - • Updated: Title and sources
• Specified: dataforest's own infrastructure
• Please refrain from individual requests to our support about the situation. You find our suggested actions in this post. Migrate your websites to new (supported) PHP versions as described below or simply shut them down until PHP updates are released as a precautionary measure. The first governments already did so with their websites.
• Due to the urgency of the situation, we have sent out a newsletter to all customers.
Oct 21, 2026 - 15:32 CEST
• Specified: dataforest's own infrastructure
• Please refrain from individual requests to our support about the situation. You find our suggested actions in this post. Migrate your websites to new (supported) PHP versions as described below or simply shut them down until PHP updates are released as a precautionary measure. The first governments already did so with their websites.
• Due to the urgency of the situation, we have sent out a newsletter to all customers.
Oct 21, 2026 - 15:32 CEST
Identified - We would like to inform you about two critical security vulnerabilities in the PHP scripting language. Please read this post carefully and in full. We ask for your understanding that information is still limited, the situation may change at any time, and this post will therefore be updated continuously. Please subscribe to our status page to receive updates and check this post regularly.
Summary
According to current assessments, these vulnerabilities allow remote code execution in all PHP versions from version 5 onwards. In simple terms, attackers can exploit them to execute arbitrary code in the context of the affected PHP application. The application only needs to be accessible over the internet. With nearly 70% of all websites using PHP, the potential impact is substantial. Of particular concern is that only PHP 8.5, 8.4, 8.3 and 8.2 still receive security updates. Websites running older PHP versions that are no longer supported should therefore be migrated to a current version immediately.
We do not want to cause panic: our specialists convened immediately, developed an action plan and have already begun implementing it. All departments are ready to respond. Nevertheless, website operators and server administrators need to remain alert and act quickly. Further information on our response and our recommendations is provided below.
Details of the vulnerabilities were originally scheduled to be published on 22.10.2026 at 17:00 CEST, after the corresponding security updates had been made available. However, information was leaked by unknown parties a few hours ago. The PHP security team has therefore announced that the release has been brought forward and is imminent.
Managed servers and web hosting
We have begun disabling outdated PHP handlers. This means that only PHP versions that still receive security updates can be selected. We strongly urge you to switch your websites to one of these versions immediately. Where necessary, isolate outdated applications that cannot be migrated immediately from the internet, then migrate them to newer software without leaving them exposed.
Please note: As soon as we become aware of a publicly available and therefore actively exploited exploit, we will immediately disable unsupported PHP versions across all managed servers and web hosting servers by switching the affected websites to PHP 8.5. You would then be able to switch back as far as PHP 8.2, but would no longer be able to select an unsupported version. We understand that this would be a drastic step, but we must consider it to protect your data and that of your customers.
For supported PHP versions, we expect updates over the coming days and will install them as soon as they become available. At present, we cannot predict whether exploits will become public and be used before then. Please assess whether you wish to isolate your PHP-powered websites from the internet until updates are available.
Unmanaged (self-managed) servers
Our recommendation: migrate outdated PHP applications to a supported PHP version immediately. Update your PHP installation as soon as updates become available for your system. If your operating system no longer receives updates, upgrade it immediately. Isolate applications from the internet if they cannot be migrated promptly.
Outlook
Once sufficient technical details are available, we will also assess whether the attack vectors can be mitigated at the web server level (for example, through a Web Application Firewall enabled by default on Plesk servers) or by other means. Until we know more, however, we must assume that running a supported PHP version and installing the corresponding updates is the only option.
dataforest's own infrastructure
- We have decided to shut down particularly critical systems as a precaution until the situation becomes clearer – especially those that handle customer data or have extensive internal permissions. This may temporarily limit certain product and server management functions. During this time, you can ask our support team at hi@dataforest.net to carry out the corresponding actions for you at any time.
- Over the coming hours and days, we reserve the right to perform maintenance on any of our customer portals, temporarily restrict access to them, or shut down legacy sites permanently without further notice.
Sources
https://www.php.net/archive/2026.php
https://cert.europa.eu/publications/security-advisories/2026-018/
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
https://www.heise.de/en/news/Critical-PHP-updates-on-Oct-21-fix-code-injection-vulnerabilities-11495177.html
https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2026/261021_PHP-kritische-Schwachstelle.html
https://www.tagesschau.de/wirtschaft/technologie/it-sicherheit-php-luecke-100.html
Oct 21, 2026 - 03:55 CEST
Summary
According to current assessments, these vulnerabilities allow remote code execution in all PHP versions from version 5 onwards. In simple terms, attackers can exploit them to execute arbitrary code in the context of the affected PHP application. The application only needs to be accessible over the internet. With nearly 70% of all websites using PHP, the potential impact is substantial. Of particular concern is that only PHP 8.5, 8.4, 8.3 and 8.2 still receive security updates. Websites running older PHP versions that are no longer supported should therefore be migrated to a current version immediately.
We do not want to cause panic: our specialists convened immediately, developed an action plan and have already begun implementing it. All departments are ready to respond. Nevertheless, website operators and server administrators need to remain alert and act quickly. Further information on our response and our recommendations is provided below.
Details of the vulnerabilities were originally scheduled to be published on 22.10.2026 at 17:00 CEST, after the corresponding security updates had been made available. However, information was leaked by unknown parties a few hours ago. The PHP security team has therefore announced that the release has been brought forward and is imminent.
Managed servers and web hosting
We have begun disabling outdated PHP handlers. This means that only PHP versions that still receive security updates can be selected. We strongly urge you to switch your websites to one of these versions immediately. Where necessary, isolate outdated applications that cannot be migrated immediately from the internet, then migrate them to newer software without leaving them exposed.
Please note: As soon as we become aware of a publicly available and therefore actively exploited exploit, we will immediately disable unsupported PHP versions across all managed servers and web hosting servers by switching the affected websites to PHP 8.5. You would then be able to switch back as far as PHP 8.2, but would no longer be able to select an unsupported version. We understand that this would be a drastic step, but we must consider it to protect your data and that of your customers.
For supported PHP versions, we expect updates over the coming days and will install them as soon as they become available. At present, we cannot predict whether exploits will become public and be used before then. Please assess whether you wish to isolate your PHP-powered websites from the internet until updates are available.
Unmanaged (self-managed) servers
Our recommendation: migrate outdated PHP applications to a supported PHP version immediately. Update your PHP installation as soon as updates become available for your system. If your operating system no longer receives updates, upgrade it immediately. Isolate applications from the internet if they cannot be migrated promptly.
Outlook
Once sufficient technical details are available, we will also assess whether the attack vectors can be mitigated at the web server level (for example, through a Web Application Firewall enabled by default on Plesk servers) or by other means. Until we know more, however, we must assume that running a supported PHP version and installing the corresponding updates is the only option.
dataforest's own infrastructure
- We have decided to shut down particularly critical systems as a precaution until the situation becomes clearer – especially those that handle customer data or have extensive internal permissions. This may temporarily limit certain product and server management functions. During this time, you can ask our support team at hi@dataforest.net to carry out the corresponding actions for you at any time.
- Over the coming hours and days, we reserve the right to perform maintenance on any of our customer portals, temporarily restrict access to them, or shut down legacy sites permanently without further notice.
Sources
https://www.php.net/archive/2026.php
https://cert.europa.eu/publications/security-advisories/2026-018/
https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
https://www.heise.de/en/news/Critical-PHP-updates-on-Oct-21-fix-code-injection-vulnerabilities-11495177.html
https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2026/261021_PHP-kritische-Schwachstelle.html
https://www.tagesschau.de/wirtschaft/technologie/it-sicherheit-php-luecke-100.html
Oct 21, 2026 - 03:55 CEST
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 12, 2026 - 08:00 CEST
Oct 12, 2026 - 08:00 CEST
Scheduled - Start: 12.10.2026, 08:00 CEST
End: 23.10.2026, 17:00 CEST
Power infrastructure upgrades will be carried out at FC-FRA4 across two phases. The work is intended to improve redundancy and operational stability while providing additional capacity for future growth. No downtime is planned for connected systems.
From 12.10.2026 to 16.10.2026, the power feeds of distribution systems A and B will be modified to improve selectivity and operational safety. The work will be performed sequentially, with only one power path being worked on at a time. During each respective phase, the affected power path will be supplied by the datacenter's diesel generator system, while UPS protection remains active throughout generator operation.
As this phase involves switching and work on the active power infrastructure, a small residual risk remains. In the (unlikely and unexpected) event of a disruption affecting the respective path, some rack feeds will become unavailable.
From 19.10.2026 to 23.10.2026, additional electrical supply lines will be installed, tested and commissioned to expand the site's power infrastructure and provide additional capacity.
We will provide an update should any unexpected impact occur.
Oct 12, 2026 08:00 - Oct 23, 2026 17:00 CEST
End: 23.10.2026, 17:00 CEST
Power infrastructure upgrades will be carried out at FC-FRA4 across two phases. The work is intended to improve redundancy and operational stability while providing additional capacity for future growth. No downtime is planned for connected systems.
From 12.10.2026 to 16.10.2026, the power feeds of distribution systems A and B will be modified to improve selectivity and operational safety. The work will be performed sequentially, with only one power path being worked on at a time. During each respective phase, the affected power path will be supplied by the datacenter's diesel generator system, while UPS protection remains active throughout generator operation.
As this phase involves switching and work on the active power infrastructure, a small residual risk remains. In the (unlikely and unexpected) event of a disruption affecting the respective path, some rack feeds will become unavailable.
From 19.10.2026 to 23.10.2026, additional electrical supply lines will be installed, tested and commissioned to expand the site's power infrastructure and provide additional capacity.
We will provide an update should any unexpected impact occur.
Oct 12, 2026 08:00 - Oct 23, 2026 17:00 CEST
dataforest Network
Operational
Edge Network (affects all locations)
Operational
DDoS Protection (affects all locations)
Operational
Dedicated Servers (EQX-FR4 & DRT-FRA8)
Operational
Datacenter MC-FRA01
Partial Outage
Datacenter Core Routing & Switching
Operational
Ceph Cluster
Operational
Virtual Servers
Partial Outage
Dedicated Servers
Operational
Plesk Web Hosting
Partial Outage
TeamSpeak3 Servers
Operational
Network Storage
Operational
Facilites
Operational
Datacenter FC-FRA4
Under Maintenance
Datacenter Core Routing & Switching
Operational
Dedicated Servers
Operational
Facilites
Under Maintenance
General Services
Partial Outage
Avoro CP & Support
Partial Outage
PHP-Friends CRM & Support
Partial Outage
Hotline
Operational
Dedicated Control Panel
Operational
IPMI VPN
Operational
DDoS Manager
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance