Xneelo incident
PHP security update: review your website for unusual activity
Ongoing since 07:47 AM UTC, affecting xneelo service.
On 21 October 2026, the PHP Foundation announced two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP-based websites worldwide, including those hosted by xneelo. Xneelo responded quickly. Before the official patches were released, we put additional recommended protections in place to reduce the risk of exploitation. Our web application firewall running on all managed servers prevented compromise via one of the known published exploits. As soon as the security updates became available, we applied them across all of our hosting servers. Although the updates protect your website against these vulnerabilities, we cannot rule out the possibility that a website may have been compromised before the updates were applied. **What you can do** As a precaution, we recommend that you: - Review your CMS administrator accounts and installed plugins or extensions for anything you don't recognise. - Check your website files for unfamiliar or recently modified files, particularly in upload directories. - Change your website administrator and FTP passwords if you suspect unauthorised access, and enable two-factor authentication where available. - As a general precaution, update your website's CMS, plugins, themes and other software to the latest versions. If you notice unusual activity, investigate it promptly and have your web developer make the necessary changes.
Affected components
Update timeline
- investigating Oct 22, 2026, 07:47 AM UTC
On 21 October 2026, the PHP Foundation announced two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP-based websites worldwide, including those hosted by xneelo. Xneelo responded quickly. Before the official patches were released, we put additional recommended protections in place to reduce the risk of exploitation. Our web application firewall running on all managed servers prevented compromise via one of the known published exploits. As soon as the security updates became available, we applied them across all of our hosting servers. Although the updates protect your website against these vulnerabilities, we cannot rule out the possibility that a website may have been compromised before the updates were applied. **What you can do** As a precaution, we recommend that you: - Review your CMS administrator accounts and installed plugins or extensions for anything you don't recognise. - Check your website files for unfamiliar or recently modified files, particularly in upload directories. - Change your website administrator and FTP passwords if you suspect unauthorised access, and enable two-factor authentication where available. - As a general precaution, update your website's CMS, plugins, themes and other software to the latest versions. If you notice unusual activity, investigate it promptly and have your web developer make the necessary changes.
Your product runs on more than Xneelo
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services