DE

PHP security vulnerability: All websites hosted with us are protected.

Carpenter at a laptop in his workshop

On Wednesday, 21 October 2026, a serious security vulnerability in PHP became public. All websites hosted with us were protected the same day and online the whole time. You don’t need to do anything.

What happened?

PHP is the technology behind the scenes that WordPress and many other websites run on. The new vulnerability would have let attackers take over an entire website without a password.

The vulnerability is called PHP2Shell. Because details had leaked in advance, experts expected a constant stream of automated attacks. SRF and Blick reported on it. Some Swiss websites were taken offline as a precaution, for example those of the Canton of Basel-Stadt.

Server room in a data centre with open server cabinets

How it unfolded

  1. Wednesday

    PHP team

    The PHP security update is released.

  2. Right after

    Hostpoint Protected from here on

    Hostpoint, where our clients’ websites are hosted, installs the update on all servers. The websites stay online.

  3. SRF

    SRF reports on the vulnerability.

  4. Hostpoint

    Hostpoint confirms by email: All websites are protected.

  5. Evening

    Swiss Media Design

    We check the situation for all our clients’ websites. Everything is up to date.

  6. Thursday

    Swiss Media Design

    We answer the first client enquiry: There is nothing to do.

  7. Result

    All websites protected, none went offline.

We did not rely on Hostpoint’s confirmation alone. We checked every website ourselves: all of them ran the protected PHP version, and we found no signs of an attack.

Hand plugging a network cable into a server rack

What does this mean for you?

If your website is hosted with us, you don’t need to do anything. It kept running normally the whole time, and the server is up to date.

If your website is with another provider, ask them whether their servers have been updated yet. A WordPress update alone is not enough here, because the vulnerability is in PHP on the server.

Ask specifically about the PHP version. Versions 8.2.35, 8.3.36, 8.4.27, 8.5.12 and later are protected. PHP 8.1 and older no longer receive updates from the PHP team.

Questions? Call us on +41 81 756 00 30 or write to us using the contact form.

Sources: SRF, 21 October 2026 and php.net, 21 October 2026