{"id":700,"date":"2026-10-22T10:36:37","date_gmt":"2026-10-22T08:36:37","guid":{"rendered":"https:\/\/swissmediadesign.com\/?p=700"},"modified":"2026-10-22T10:36:37","modified_gmt":"2026-10-22T08:36:37","slug":"php-security-vulnerability-website","status":"publish","type":"post","link":"https:\/\/swissmediadesign.com\/en\/php-sicherheitsluecke-website\/","title":{"rendered":"PHP security vulnerability: All websites hosted with us are protected."},"content":{"rendered":"<p class=\"wp-block-paragraph\">On Wednesday, 21 October 2026, a serious security vulnerability in PHP became public. All websites hosted with us were protected the same day and online the whole time. You don\u2019t need to do anything.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP is the technology behind the scenes that WordPress and many other websites run on. The new vulnerability would have let attackers take over an entire website without a password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability is called PHP2Shell. Because details had leaked in advance, experts expected a constant stream of automated attacks. SRF and Blick reported on it. Some Swiss websites were taken offline as a precaution, for example those of the Canton of Basel-Stadt.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-serverraum-1024x576.webp\" alt=\"Server room in a data centre with open server cabinets\" class=\"wp-image-703\" srcset=\"https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-serverraum-1024x576.webp 1024w, https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-serverraum-300x169.webp 300w, https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-serverraum-768x432.webp 768w, https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-serverraum-1536x864.webp 1536w, https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-serverraum-18x10.webp 18w, https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-serverraum.webp 1600w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">How it unfolded<\/h2>\n\n\n\n<style>\n.php-zeitstrahl {\n  --zs-zeit: 11rem;\n  --zs-schiene: 2.5rem;\n  --zs-punkt: 0.875rem;\n  --zs-oben: 0.55rem;\n  margin: var(--space-3) 0 var(--space-4);\n  padding: 0;\n  list-style: none;\n  border-top: 1px solid var(--line);\n}\n.php-zeitstrahl__punkt {\n  position: relative;\n  display: grid;\n  grid-template-columns: var(--zs-zeit) var(--zs-schiene) 1fr;\n  margin: 0;\n  padding: var(--space-3) 0 0;\n}\n.php-zeitstrahl__punkt:last-child { padding-bottom: var(--space-2); }\n\/* Schiene: Segment je Punkt, vom eigenen Punkt bis zum naechsten. *\/\n.php-zeitstrahl__punkt::before {\n  content: \"\";\n  position: absolute;\n  left: calc(var(--zs-zeit) + var(--zs-schiene) \/ 2 - 1px);\n  top: calc(var(--space-3) + var(--zs-oben) + var(--zs-punkt) \/ 2);\n  bottom: calc(-1 * (var(--zs-oben) + var(--zs-punkt) \/ 2));\n  width: 2px;\n  background: var(--line-strong);\n}\n.php-zeitstrahl__punkt:last-child::before { display: none; }\n.php-zeitstrahl__punkt.ist-geschuetzt::before,\n.php-zeitstrahl__punkt.ist-geschuetzt ~ .php-zeitstrahl__punkt::before {\n  background: linear-gradient(180deg, var(--accent), var(--accent-2));\n}\n\/* Punkt auf der Schiene *\/\n.php-zeitstrahl__punkt::after {\n  content: \"\";\n  position: absolute;\n  left: calc(var(--zs-zeit) + var(--zs-schiene) \/ 2 - var(--zs-punkt) \/ 2);\n  top: calc(var(--space-3) + var(--zs-oben));\n  width: var(--zs-punkt);\n  height: var(--zs-punkt);\n  box-sizing: border-box;\n  border-radius: 50%;\n  border: 2px solid var(--line-strong);\n  background: var(--bg);\n}\n.php-zeitstrahl__punkt.ist-geschuetzt::after,\n.php-zeitstrahl__punkt.ist-geschuetzt ~ .php-zeitstrahl__punkt::after { border-color: var(--accent); }\n.php-zeitstrahl__punkt.ist-smd::after { background: var(--accent); border-color: var(--accent); }\n.php-zeitstrahl__wann { grid-column: 1; margin: 0; }\n.php-zeitstrahl__tag {\n  display: block;\n  font-size: 0.78rem;\n  font-weight: 600;\n  letter-spacing: 0.08em;\n  text-transform: uppercase;\n  color: var(--ink-faint);\n}\n.php-zeitstrahl__zeit {\n  display: block;\n  margin-top: 0.15rem;\n  font-family: var(--font-display);\n  font-size: 1.45rem;\n  font-weight: 700;\n  line-height: 1.1;\n  letter-spacing: -0.02em;\n  font-variant-numeric: tabular-nums;\n  white-space: nowrap;\n  color: var(--ink);\n}\n.php-zeitstrahl__punkt.ist-smd .php-zeitstrahl__zeit {\n  background: var(--accent-grad);\n  -webkit-background-clip: text;\n  background-clip: text;\n  color: transparent;\n}\n.php-zeitstrahl__inhalt { grid-column: 3; padding-top: 0.1rem; }\n.php-zeitstrahl__wer {\n  display: flex;\n  flex-wrap: wrap;\n  align-items: center;\n  gap: 0.5rem;\n  margin: 0 0 0.35rem;\n  font-size: 0.78rem;\n  font-weight: 600;\n  letter-spacing: 0.08em;\n  text-transform: uppercase;\n  color: var(--ink-faint);\n}\n.php-zeitstrahl__punkt.ist-smd .php-zeitstrahl__wer { color: var(--accent); }\n.php-zeitstrahl__marke {\n  padding: 0.15rem 0.5rem;\n  border: 1px solid var(--accent);\n  border-radius: var(--radius-s);\n  color: var(--accent);\n  letter-spacing: 0.06em;\n}\n.php-zeitstrahl__text { margin: 0; color: var(--ink); }\n\/* Schlussmarke: grosser gefuellter Punkt, Ergebnis in der Display-Schrift *\/\n.php-zeitstrahl__punkt.ist-ergebnis { --zs-punkt: 1.25rem; --zs-oben: 0.35rem; }\n.php-zeitstrahl__punkt.ist-ergebnis::after { background: var(--accent); border-color: var(--accent); }\n.php-zeitstrahl__punkt.ist-ergebnis .php-zeitstrahl__wer { color: var(--accent); }\n.php-zeitstrahl__fazit {\n  margin: 0;\n  font-family: var(--font-display);\n  font-size: 1.5rem;\n  font-weight: 700;\n  line-height: 1.2;\n  letter-spacing: -0.02em;\n  color: var(--ink);\n}\n@media (max-width: 47.99rem) {\n  .php-zeitstrahl { --zs-schiene: 2rem; }\n  .php-zeitstrahl__punkt { grid-template-columns: var(--zs-schiene) 1fr; }\n  .php-zeitstrahl__punkt::before { left: calc(var(--zs-schiene) \/ 2 - 1px); }\n  .php-zeitstrahl__punkt::after { left: calc(var(--zs-schiene) \/ 2 - var(--zs-punkt) \/ 2); }\n  .php-zeitstrahl__wann,\n  .php-zeitstrahl__inhalt { grid-column: 2; }\n  .php-zeitstrahl__inhalt { padding-top: 0.5rem; }\n  .php-zeitstrahl__zeit { font-size: 1.35rem; }\n  .php-zeitstrahl__punkt.ist-ergebnis .php-zeitstrahl__inhalt { padding-top: 0; }\n  .php-zeitstrahl__fazit { font-size: 1.3rem; }\n}\n<\/style>\n<ol class=\"php-zeitstrahl\">\n<li class=\"php-zeitstrahl__punkt\">\n<p class=\"php-zeitstrahl__wann\"><span class=\"php-zeitstrahl__tag\">Wednesday<\/span><time class=\"php-zeitstrahl__zeit\" datetime=\"2026-10-21T16:00+02:00\">around 4 pm<\/time><\/p>\n<div class=\"php-zeitstrahl__inhalt\"><p class=\"php-zeitstrahl__wer\">PHP team<\/p><p class=\"php-zeitstrahl__text\">The PHP security update is released.<\/p><\/div>\n<\/li>\n<li class=\"php-zeitstrahl__punkt ist-geschuetzt\">\n<p class=\"php-zeitstrahl__wann\"><span class=\"php-zeitstrahl__zeit\">Right after<\/span><\/p>\n<div class=\"php-zeitstrahl__inhalt\"><p class=\"php-zeitstrahl__wer\">Hostpoint <span class=\"php-zeitstrahl__marke\">Protected from here on<\/span><\/p><p class=\"php-zeitstrahl__text\">Hostpoint, where our clients\u2019 websites are hosted, installs the update on all servers. The websites stay online.<\/p><\/div>\n<\/li>\n<li class=\"php-zeitstrahl__punkt\">\n<p class=\"php-zeitstrahl__wann\"><time class=\"php-zeitstrahl__zeit\" datetime=\"2026-10-21T17:07+02:00\">5.07 pm<\/time><\/p>\n<div class=\"php-zeitstrahl__inhalt\"><p class=\"php-zeitstrahl__wer\">SRF<\/p><p class=\"php-zeitstrahl__text\">SRF reports on the vulnerability.<\/p><\/div>\n<\/li>\n<li class=\"php-zeitstrahl__punkt\">\n<p class=\"php-zeitstrahl__wann\"><time class=\"php-zeitstrahl__zeit\" datetime=\"2026-10-21T20:18+02:00\">8.18 pm<\/time><\/p>\n<div class=\"php-zeitstrahl__inhalt\"><p class=\"php-zeitstrahl__wer\">Hostpoint<\/p><p class=\"php-zeitstrahl__text\">Hostpoint confirms by email: All websites are protected.<\/p><\/div>\n<\/li>\n<li class=\"php-zeitstrahl__punkt ist-smd\">\n<p class=\"php-zeitstrahl__wann\"><span class=\"php-zeitstrahl__zeit\">Evening<\/span><\/p>\n<div class=\"php-zeitstrahl__inhalt\"><p class=\"php-zeitstrahl__wer\">Swiss Media Design<\/p><p class=\"php-zeitstrahl__text\">We check the situation for all our clients\u2019 websites. Everything is up to date.<\/p><\/div>\n<\/li>\n<li class=\"php-zeitstrahl__punkt ist-smd\">\n<p class=\"php-zeitstrahl__wann\"><span class=\"php-zeitstrahl__tag\">Thursday<\/span><time class=\"php-zeitstrahl__zeit\" datetime=\"2026-10-22T06:43+02:00\">6.43 am<\/time><\/p>\n<div class=\"php-zeitstrahl__inhalt\"><p class=\"php-zeitstrahl__wer\">Swiss Media Design<\/p><p class=\"php-zeitstrahl__text\">We answer the first client enquiry: There is nothing to do.<\/p><\/div>\n<\/li>\n<li class=\"php-zeitstrahl__punkt ist-ergebnis\">\n<div class=\"php-zeitstrahl__inhalt\"><p class=\"php-zeitstrahl__wer\">Result<\/p><p class=\"php-zeitstrahl__fazit\">All websites protected, none went offline.<\/p><\/div>\n<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">We did not rely on Hostpoint\u2019s confirmation alone. We checked every website ourselves: all of them ran the protected PHP version, and we found no signs of an attack.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-netzwerkkabel-1024x576.webp\" alt=\"Hand plugging a network cable into a server rack\" class=\"wp-image-709\" srcset=\"https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-netzwerkkabel-1024x576.webp 1024w, https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-netzwerkkabel-300x169.webp 300w, https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-netzwerkkabel-768x432.webp 768w, https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-netzwerkkabel-1536x864.webp 1536w, https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-netzwerkkabel-18x10.webp 18w, https:\/\/swissmediadesign.com\/wp-content\/uploads\/2026\/10\/php-sicherheitsluecke-netzwerkkabel.webp 1600w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What does this mean for you?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your website is hosted with us, you don\u2019t need to do anything. It kept running normally the whole time, and the server is up to date.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your website is with another provider, ask them whether their servers have been updated yet. A WordPress update alone is not enough here, because the vulnerability is in PHP on the server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ask specifically about the PHP version. Versions 8.2.35, 8.3.36, 8.4.27, 8.5.12 and later are protected. PHP 8.1 and older no longer receive updates from the PHP team.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Questions? Call us on +41 81 756 00 30 or write to us using the <a href=\"\/en\/contact\/\">contact form<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sources: <a href=\"https:\/\/www.srf.ch\/news\/wirtschaft\/cybersicherheit-gravierende-php-sicherheitsluecke-bedroht-millionen-webseiten\" target=\"_blank\" rel=\"noopener\">SRF, 21 October 2026<\/a> and <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener\">php.net, 21 October 2026<\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>On 21 October, a serious security vulnerability in PHP became public. All websites hosted with us were protected the same day. You don\u2019t need to do anything.<\/p>","protected":false},"author":2,"featured_media":707,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-700","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-allgemein"],"_links":{"self":[{"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/posts\/700","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/comments?post=700"}],"version-history":[{"count":2,"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/posts\/700\/revisions"}],"predecessor-version":[{"id":710,"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/posts\/700\/revisions\/710"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/media\/707"}],"wp:attachment":[{"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/media?parent=700"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/categories?post=700"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissmediadesign.com\/en\/wp-json\/wp\/v2\/tags?post=700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}