WevrLabs is currently experiencing a major incident affecting Shared Hosting Services (Shared Server #1) and Shared Hosting Services (Shared Server #2) and 1 more component, which began 10h ago. The vendor's full update timeline is below.
Affected components
Update timeline
- investigating Oct 21, 2026, 08:45 AM UTC
Summary On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks [1,2,3]. This is a general incident and, while not related to specific services, since almost all applications on the internet run on PHP, including our dashboard area, main portal, and other 3rd-party integrations, you may notice degraded performance on some componenets, including for example, domain operations (registration, renewal, editing nameservers, etc), access to our dashboard area, etc. Following the advisory, we may conisder closing access to our Dashboard area until the patch is released by PHP and then implemented across applications. At this time, no technical details have been made public. CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available. https://cert.europa.eu/publications/security-advisories/2026-018/ The PHP team has scheduled the release for 21 October 2026 at 14:00 UTC [1]. Technical Details No technical details are currently available for CVE-2026-109618 and CVE-2026-109619, apart from their CVSS scores of 9.2, which indicate the potential for unauthenticated remote code execution [1]. Affected Products These vulnerabilities could affect all PHP versions from PHP 5 onwards [2]. Recommendations CERT-EU strongly recommends identifying PHP-based applications and preparing to patch as soon as fixed versions become available. Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied. References [1] https://www.php.net/archive/2026.php#2026-10-20-1 [2] https://cyberplace.social/@GossiTheDog/117474220875882526 [3] https://x.com/watchtowrcyber/status/2112611507749982605