PHP-vulnerabilities: Websites and hosting at IONOS Group brands are protected.

Two critical vulnerabilities in the PHP core were disclosed yesterday. Attackers could exploit them to run their own code on a website and gain access to customer data. PHP installations worldwide are affected, regardless of hosting provider. On October 21, 2026, the PHP project released security updates to fix these vulnerabilities.

At the IONOS Group brands, PHP is used by services including Web Hosting, Managed WordPress, website builders such as MyWebsite 8, Managed Nextcloud and HiDrive Next. IONOS already rolled out the official updates across all platforms it operates itself. Customers do not need to take any action. Anyone running PHP themselves-for example, on a VPS or dedicated server-should install the update for the latest PHP version immediately. IONOS is publishing the latest information at https://www.ionos-status.com/.

IONOS Group implemented additional protective measures before the updates were released. Its hosting platforms use customized PHP configurations and active firewall rules to block suspicious requests and reduce risk. However, only the official update can permanently fix the vulnerabilities.