Major incident

Fasthosts: Security maintenance: Short interruptions possible on PHP-based services

Affected: Control Panel, Webhosting, WordPress Hosting

Current status of Fasthosts: Operational — live Fasthosts status

Timeline

1. Oct 21, 2026, 15:10 UTC
   identified
   What’s happening? A critical security gap has been found in PHP, a technology used by many websites and web applications worldwide. The PHP developers and national security authorities have issued urgent warnings and recommend installing the security update immediately, as attacks are expected within hours. To protect you and your data, we’re installing the security update across our systems right now. We expect to be finished within the next 24 hours. What does this mean for you? While we update our systems, some websites and services may be slow or briefly unavailable. We’re taking this step to protect you. If you run a self-managed application, for example on a VPS or Bare Metal Server, please install the PHP security update as soon as possible to protect your systems. You can find more information here: https://www.php.net/ Thank you for your patience and understanding.
2. Oct 22, 2026, 04:56 UTC
   identified
   We are still working on resolving the technical issue. Thank you for your patience.
3. Oct 22, 2026, 09:18 UTC
   monitoring
   The systems are stable and all services are functioning normally again. Further information regarding the security vulnerability can be found at https://www.fasthosts.co.uk/guides#/articles/php2shell-php-security-vulnerability-what-you-need-to-know----29ad10f3-3b6a-40f1-89b6-b54433d3e627
4. Oct 22, 2026, 14:46 UTC
   resolved
   Two critical vulnerabilities in the PHP core were disclosed on 21 October. Attackers could exploit them to run their own code on a website and gain access to customer data. PHP installations worldwide are affected, regardless of hosting provider. On 21 October 2026, the PHP project released security updates to fix these vulnerabilities. At Fasthosts, PHP is used by services including Web Hosting, Hosting for WordPress and Website Builder. Fasthosts is currently rolling out the official updates across all platforms it operates itself. Customers don’t need to take any action. Anyone running PHP themselves, for example on a VPS or Dedicated Server, should install the update for the latest PHP version immediately. Fasthosts put additional protective measures in place before the updates were released. Its hosting platforms use customised PHP configurations and active firewall rules to block suspicious requests and reduce risk. But only the official update can permanently fix the vulnerabilities. Beware of phishing. Fraudsters often exploit vulnerabilities like these in phishing attempts, sending fake emails to get login credentials. Fasthosts advises customers not to click links in emails referring to the PHP vulnerabilities, and not to enter their login details.

Updates as published by Fasthosts (original).