On 21 October, two critical vulnerabilities in PHP became public before a fix was available (PHP2Shell, CVE-2026-109618 and CVE-2026-109619). PHP is the software that most websites run on, including WordPress, WooCommerce and many other systems. Attackers could use these vulnerabilities to take over a server without logging in. Attacks were already reported that morning, and many large organisations, such as the Tweede Kamer, the NCSC and Tweakers, took their websites offline as a precaution.

We want to explain what we did and what it means for you.

What we did

From around 12:00, we took measures on all our web servers to block the attack before a patch was available. We first blocked file uploads and form submissions. After that, we temporarily took all websites that use PHP offline completely and showed a maintenance page. Webmail, phpMyAdmin and our client area were also unavailable during this time. Static websites, email in your mail app, game servers and other services kept running normally.

The PHP security update was released at 16:00. We installed it on all servers right away, and by around 17:00 all websites and services were back online.

Checks before bringing everything back online

Before we put websites back online, we checked our servers for anything that could still make a website unsafe. We found websites with old settings that pointed to older PHP versions that had not been patched yet. We fixed these and informed the owners directly. The alternative PHP versions in the PHP Selector are temporarily disabled until they are patched as well. All websites now run on our standard, fully updated and patched PHP versions.

We found no signs of abuse on our servers.

What this means for you

In most cases, you don't need to do anything. We do recommend the following:

  • If you use WordPress or another CMS, check that your plugins and themes are up to date.
  • If you made a payment to us on 21 October that doesn't show up in your client area, let us know and we will look into it.
  • If you need a specific PHP version other than 8.3, contact us. We will make the alternative versions available again once they are patched.
  • If something on your website doesn't work as it should, open a ticket and we will help you.

We understand that having your website offline for a few hours is inconvenient. The security of your website and data is our top priority. Because the risk of a takeover was too high, we chose to take websites offline temporarily rather than take any chances.

If you have any questions, contact us through our client area or at info@heo-systems.com.