Critical PHP security vulnerability ("PHP2Shell"): Why we temporarily took our systems offline as a precaution

On October 21, 2026, the Federal Office for Information Security (BSI) and the European CERT warned of two extremely critical security vulnerabilities in the programming language PHP. Countless websites, online shops, and web applications worldwide were acutely at risk – including widely used content management systems and platforms such as WordPress, Drupal, TYPO3, Joomla, Magento, Nextcloud, pfSense, and OPNsense, all of which are based on PHP.

At e-pixler, we also responded immediately, activated protective filters, and temporarily took our systems offline as a precaution. We summarize here transparently why this decisive decision was necessary, what happened behind the scenes, and what this means for your systems.

What happened?

Under the name "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619) two vulnerabilities were announced on October 21 that were classified as highly critical on the official danger scale with 9.2 out of 10 points. Through manipulated file uploads, attackers were able to execute malicious code remotely on affected servers without prior authentication and, in the worst case, take complete control of them.

Since details of the vulnerability had already leaked before the official publication and initial attack scripts (exploits) were circulating online, the European CERT recommended a drastic step: affected systems should be taken offline until an effective security update (patch) could be applied.

Important to know: The vulnerabilities lay in the core PHP technology itself and were not a specific problem of e-pixler or individual hosting providers.

How did we respond?

Since PHP forms the foundation of almost all modern web applications, our technical and security teams immediately implemented a multi-stage emergency plan as soon as the threat became known, which continued deep into the night:

1. Immediate protection via our cloud SSL termination gateways: Before official updates from the PHP developers were available, we set up a special protection rule on our upstream cloud SSL termination gateways. This intercepted the known attack vector (file uploads) right at the entry point to our infrastructure, before requests even reached the actual servers.
2. Precautionary emergency shutdown: To eliminate any residual risk, we followed the recommendation of the European CERT and took the websites offline as a precaution. Special high-availability solutions (dark sites) for critical infrastructures activated as planned and fully automatically.
3. Comprehensive patching and server restarts: Immediately after the security updates were released, we updated the PHP interpreters on all servers of our infrastructure. All systems were then restarted in a controlled manner to ensure that no old, vulnerable processes continued running in memory.
4. Emergency upgrade for older PHP versions (PHP 8.1 and older): For PHP versions below 8.2, the official PHP project no longer provides regular security updates. To avoid leaving these systems unprotected, we quickly switched numerous affected domains to PHP 8.2 and completely removed outdated PHP interpreters from the servers.
5. Controlled return to service: After a systematic review of each individual server, the systems were gradually released again. All systems are now back in regular, secured operation.

We understand that the temporary unavailability was inconvenient for you and your users. Nevertheless, the decision was clear to us: Protecting your data outweighs a few hours of downtime.

Were customer data at risk?

An installed update closes the vulnerability for the future – but our work does not end there. To make sure that no successful access occurred before the patch, we are currently conducting a thorough integrity check (threat hunting):

• AI-assisted log analysis (in anonymized form): We are currently retrospectively analyzing the server logs from the entire past week. This amounts to several GB of data or millions of log lines per day, which are fully in anonymized formprocessed and checked for suspicious patterns using our AI system and under ongoing monitoring by our security team.
• Close process monitoring:In addition, all servers are currently being automatically checked for unusual process activity.

So far, there is no indication of compromised systems. If irregularities should emerge for individual systems during the further analysis, we will inform the affected customers immediately and individually.

Important notes: What does this mean for you as a customer now?

For all customers with corresponding maintenance and support contracts, we have already fully implemented all protective measures. Nevertheless, we ask you to note two points:

• Check after PHP 8.2 migration: If your website previously ran on an outdated PHP version (8.1 or older), we had to upgrade it to PHP 8.2 without prior notice for your protection. Please briefly check your website or web application for unusual behavior (e.g. with older plugins or forms). Our project teams are already proactively reaching out to affected customers as well.
• Possible access blocks due to stricter firewalls: Our attack detection systems are currently deliberately set very sensitively. If you or your employees can suddenly no longer access your website, the CMS backend, or your mailbox, your IP address may have been blocked as a precaution. In this case, simply contact our support briefly – we will check this immediately and restore your access right away.

Our conclusion: IT security requires consistency

The incident shows how quickly a vulnerability in a central web technology can have worldwide effects. For us as a digital agency with our own hosting, responsibility means not relying solely on standard processes, but acting quickly, in multiple stages, and consistently in an emergency.

We sincerely thank you for your understanding, your patience during the short interruption, and your trust in our work.

Your e-pixler team 💙

Further information

• BSI: Critical PHP vulnerabilities from October 21, 2026
• PHP: Official website and security updates

Image note: This image was generated with the help of artificial intelligence (AI).