Critical PHP vulnerability: websites temporarily restricted
Status: Updates in progressLast updated: 21 October 2026, 17:30 CEST
Because of a critical security vulnerability in PHP, we are temporarily taking affected websites offline or protecting them with a password until the security update is installed. We expect the interruption to last no more than two hours.
What happened?
On 21 October 2026, the PHP project disclosed two serious security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10). PHP is the programming language that WordPress and a large share of all websites worldwide run on. The vulnerabilities let attackers run their own code on a web server without any credentials and take over a website.
The fix has been available since 21 October 2026, 16:00 CEST, and now has to be installed on every server. According to the PHP project, there is no complete workaround. Germany's Federal Office for Information Security (BSI) expects the vulnerability to be exploited widely within a few hours. CERT-EU, the cybersecurity team of the EU institutions, recommends isolating internet-facing applications from the public internet until the update is installed.
What we are doing
We are going through all the websites we manage. Where the fix is still missing, we temporarily take the website offline or protect it with a password. Some hosting providers have already switched off PHP themselves until they have installed the fix. As soon as the fix is installed and checked, we bring the website back online.
If your website is currently unreachable or asks for a login, this is intentional and protects it. Contact forms and orders do not work during this time. Your email is not affected.
Do you need to do anything?
No, there is nothing you need to do. If your website runs on an older PHP version that no longer receives official updates, it may take longer. In that case, we will contact you directly.
If you have any questions, please contact us.
Cross-Link GmbH