php2shell investigation
- Category
- General (Notification)
- Status
- Resolved
- Start
- End
We are currently investigating the php2shell vulnerabilities.
Update on
We are deploying mitigations.
Update on
We are closely monitoring the recently disclosed PHP2Shell vulnerability, which affects core PHP multipart/form-data handling. We have implemented initial mitigations for this security flaw, but these are not guaranteed to be effective. Official security patches from the PHP development team are expected today at 16:00 CEST and will be deployed as soon as they become available to us. In the meantime, our team is continuously monitoring the situation and applying additional mitigating measures where possible. Because current mitigations may not prevent exploitation, we advise you to assess the potential impact on your specific applications and weigh whether to take any additional precautionary measures.
Update on
Due to a high volume of incoming calls and increasing wait times, we are currently unavailable by phone. You can contact us by creating a ticket in our control panel or by sending an email.
Update on
As a precautionary measure, access to our hosting control panels has been temporarily restricted due to the current PHP2Shell vulnerability. All hosted applications and websites remain fully operational. If you have any questions or requests, please reach out to our support team.
Update on
Our team is currently preparing for the deployment of the official security patches for the PHP vulnerability, which are expected from 16:00 CEST. While the exact time of full resolution remains uncertain due to external factors, we are doing everything in our power to roll out the patches as quickly as possible. To prevent exploitation in the meantime, we have taken the precautionary measure to temporarily disable PHP across our managed services. As a result, PHP applications are currently unavailable and will be re-enabled as soon as the official security update has been fully applied. More information about this will be provided to our customers through an e-mail. Please account for potential service disruptions during these maintenance operations. We understand the significant impact of this action and are committed to keeping downtime to an absolute minimum. If you have any questions, please do not hesitate to reach out to our support team.
Update on
The PHP team has officially released the security patches. Our team is actively working on applying these updates across our infrastructure. Because we depend on various upstream sources and software repositories, there may be a slight delay before the patch becomes available for all specific systems and PHP versions. Rest assured, we are applying these critical security updates as quickly as possible.
Update on
Patching is currently still ongoing. We are applying the security updates as quickly as possible as they become available from upstream repositories and external sources.
Update on
Some customers have reported delays in receiving emails we sent today regarding this vulnerability. This appears to be caused by delays at major external email providers and is unrelated to the vulnerability itself. As a result, customers may have received an update containing outdated information. The latest communications from us is available at my.shockmedia.nl and this website. Patching is currently still ongoing as more patches become available through several sources and repositories.
Update on
The deployment of the security patches is progressing steadily and is now at an advanced stage. Patches have been successfully applied across the vast majority of our hosting infrastructure. We are currently finalizing the rollout across our Ubuntu and DirectAdmin server fleets. For the remaining specific environments, such as our Managed App platform, our teams are standing by to apply the updates immediately as upstream vendors release them. Environments and services are being brought fully back online in phases as soon as patching and verification are complete.
Update on
Patching operations across our infrastructure are at an advanced stage for both (Cloud) servers and our Managed App platform. As a result, an increasing number of applications are progressively coming back online. However, for certain specific cases and particular PHP versions, we remain dependent on upstream repositories to release the required patches. As soon as these external updates become available, we will deploy them immediately and restore the remaining environments.
Update on
Patching across our infrastructure is now largely complete, with most services restored. At this stage, we are primarily awaiting the release of official PHP updates for CloudLinux environments. We are actively monitoring CloudLinux upstream repositories to deploy these patches immediately as soon as possible after release.
Update on
We have been in direct contact with CloudLinux regarding the availability of the security updates. Based on this communication, we expect the CloudLinux patch releases to become available at approximately 01:00 CEST. Our teams are standing by to deploy the patches immediately upon release, after which these CloudLinux environments will be restored to full availability as quickly as possible.
Update on
The CloudLinux environments are patched as well and are available again. This concludes our patching, but we will keep this incident open for future communication.
Update on
If you are using a webhosting or a reseller package, PHP versions 5.2-5.6, 7.0-7.4 and 8.0-8.5 have been patched last night.
Update on
Security patches have been broadly applied across our entire infrastructure last night. Our primary focus has shifted to final checks and actively assisting customers in ensuring all their applications are fully accessible and operating smoothly.
Update on
We are currently still monitoring the situation closely.
Update on
Patching across our entire infrastructure has been successfully completed, and supported PHP services are fully operational. Our team continues to monitor the situation and our infrastructure closely 24*7. This concludes our status page updates for this incident. Should you have any remaining questions or require support, our team is available to assist you.