Critical PHP security vulnerability (“PHP2Shell”): Why we took our systems offline as a precaution

On October 21, 2026, the German Federal Office for Information Security (BSI) and the European CERT warned of two extremely critical security vulnerabilities in the programming language PHP. Countless websites, shops, and content management systems such as TYPO3 and WordPress worldwide were acutely at risk.

At e-pixler, we also responded immediately, activated protective filters, and temporarily took our systems offline as a precaution. We explain transparently here why this consistent decision was necessary, what happened behind the scenes, and what it means for your systems.

What happened?

Under the name “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619) two vulnerabilities were announced on October 21, which were classified as highly critical on the official danger scale with 9.2 out of 10 points. Through manipulated file uploads, attackers were able to execute malicious code remotely on affected servers without prior authentication and, in the worst case, take them over completely.

Since details about the vulnerability had already leaked before the official publication and initial attack scripts (exploits) were circulating online, the European CERT recommended a drastic step: affected systems should be taken off the network until an effective security update (patch) could be applied.

Important to know: The vulnerabilities were in the core PHP technology itself and were not a specific problem of e-pixler or individual hosting providers.

How did we respond?

Since PHP forms the foundation of almost all modern web applications, our technical and security teams implemented a multi-stage emergency plan immediately after the threat became known, which continued deep into the night:

1. Immediate protection via our cloud SSL termination gateways: Before official updates from the PHP developers were available, we set up a special protective rule on our upstream cloud SSL termination gateways. This intercepted the known attack vector (file uploads) right at the entrance to our infrastructure, before requests even reached the actual servers.
2. Precautionary emergency shutdown: To eliminate any residual risk, we followed the recommendation of the European CERT and took the websites offline as a precaution. Special high-availability solutions (dark sites) for critical infrastructure activated as planned and fully automatically.
3. Comprehensive patching and server restarts: Immediately after the security updates were released, we updated the PHP interpreters on all servers in our infrastructure. All systems were then restarted in a controlled manner to ensure that no old, vulnerable processes continued running in memory.
4. Emergency upgrade for older PHP versions (PHP 8.1 and older): For PHP versions below 8.2, the official PHP project no longer provides regular security updates. To avoid leaving these systems unprotected, we quickly switched numerous affected domains to PHP 8.2 and completely removed outdated PHP interpreters from the servers.
5. Controlled return to service: After a systematic check of each individual server, the systems were gradually re-enabled. All systems are therefore running again in regular, secured operation.

We are aware that the temporary unavailability was inconvenient for you and your users. Nevertheless, the decision was clear to us: Protecting your data outweighs a few hours of downtime.

Were customer data at risk?

A deployed update closes the vulnerability for the future — but our work does not end there. To make sure that no successful access occurred before the patch, we are currently carrying out an in-depth integrity check (threat hunting):

• AI-supported log analysis (in anonymized form): We are currently retrospectively evaluating the server logs from the entire past week. This corresponds to several GB of data or millions of log lines per day, all of which are fully in anonymized formprocessed and checked for suspicious patterns using our AI system and under ongoing monitoring by our Security Team.
• Close process monitoring:In addition, all servers are currently being automatically checked for unusual process activity.

So far, there are no indications of compromised systems. Should any anomalies emerge for individual systems during the further analysis, we will inform the affected customers immediately and individually.

Important note: What does this mean for you as a customer?

For all customers with соответствing maintenance and support contracts, we have already fully implemented all protective measures. Nevertheless, we ask you to note two points:

• Review after PHP 8.2 upgrade:If your website was previously still running on an outdated PHP version (8.1 or older), we had to upgrade it to PHP 8.2 unexpectedly for your protection. Please briefly check your website or web application for unusual behavior (e.g. with older plugins or forms). Our project teams are also proactively reaching out to affected customers.
• Possible access restrictions due to stricter firewalls:Our attack detection systems are currently deliberately set to be very sensitive. If you or your employees can suddenly no longer access your website, the CMS backend, or your mailbox, your IP address may have been blocked as a precaution. In that case, simply contact our support briefly – we will check this immediately and restore your access right away.

Our conclusion: IT security requires consistency

This incident shows how quickly a vulnerability in a central web technology can have worldwide effects. For us as a digital agency with our own hosting, responsibility means not relying solely on standard processes, but acting quickly, in multiple stages, and consistently in an emergency.

We sincerely thank you for your understanding, your patience during the brief interruption, and your trust in our work.

Your e-pixler team 💙

Further information

• BSI: Critical PHP vulnerabilities from October 21, 2026
• PHP: Official website and security updates

Image note: This image was generated with the help of artificial intelligence (AI).