We would like to inform you of a significant security development that is currently affecting websites and web applications worldwide.

Over the past 48 hours, critical vulnerabilities have been disclosed in PHP, the server-side technology that powers a substantial portion of the internet, including WordPress websites, e-commerce platforms, customer portals, bespoke web applications, and many other online services. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, may allow unauthenticated attackers to execute malicious code on vulnerable servers. Security experts have classified these vulnerabilities as Critical (CVSS 9.2) and have strongly recommended immediate remediation.

PHP released emergency security updates on 21 October 2026, and multiple cybersecurity organizations have advised website owners and hosting providers to update affected systems immediately or consider disabling vulnerable services until appropriate patches can be applied.

At OndNet, the security of our hosting infrastructure and the protection of our clients' data remain our highest priorities. Since the publication of these vulnerabilities, we have implemented initial mitigation measures and have been actively assessing all affected servers. However, security experts agree that mitigation alone is not considered a complete solution and that updating to patched PHP versions is the recommended course of action.

What This Means for Your Website

To ensure the continued security of our hosting environment, we will be upgrading all websites to supported and patched PHP versions wherever technically possible.

Unfortunately, some older websites, applications, themes, and plugins were developed for legacy PHP versions and may not be compatible with the latest secure releases. As a result, the following may occur:

  • Certain website functions may stop working correctly.
  • Specific pages, forms, or sections of a website may generate errors.
  • In some cases, websites may become partially or completely unavailable until compatibility issues are resolved.
  • Older websites that cannot be safely upgraded to a secure PHP version may need to be temporarily suspended to protect both the hosting infrastructure and customer data.

While we understand that this may cause inconvenience, these measures are necessary to reduce the risk of server compromise and protect the data and services entrusted to us.

Websites Covered by Maintenance Agreements

Where possible, websites covered by an active maintenance or support agreement have already been updated. Clients whose websites require further review, compatibility checks, or additional development work will be contacted individually to discuss the most suitable next steps.

Websites Without Active Maintenance

For websites that are no longer under maintenance, compatibility issues may be identified following the PHP upgrade. In such cases, clients may need to engage in a website update, redevelopment, or migration project to restore full functionality while maintaining security compliance.

Our Commitment

We recognise the importance of maintaining uninterrupted online services. Our technical teams are working around the clock to minimise disruption while ensuring that all reasonable steps are taken to protect our infrastructure and client data from emerging threats.

We appreciate your understanding and cooperation during this period. Whilst security-driven changes can occasionally impact legacy systems, they are essential in maintaining a secure hosting environment for all customers.

For additional information regarding these vulnerabilities, please refer to:

Should you have any questions regarding your website or hosting service, please do not hesitate to contact us.

Kind regards,

The OndNet Technical Team



Jueves, Octubre 22, 2026





« Atrás