Update on the PHP security situation

What happened?

At approximately 11:30 on Wednesday 21 October, our hosting partner informed us of two highly critical PHP security vulnerabilities known as PHP2Shell. These vulnerabilities, with a severity score of 9.2 out of 10, could under certain circumstances be exploited to execute unauthorised commands remotely on vulnerable servers. The vulnerabilities affected PHP itself, a programming language used by millions of websites and applications worldwide.

Technical background: Akamai’s analysis of PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The timeline below describes Surlinio’s own response.

At the time of the notification, no official security updates were available and the effectiveness of possible temporary security measures was uncertain.

Why did we decide to take websites temporarily offline?

Immediately after receiving the notification, we began our investigation and consulted extensively with clients, other hosting providers and our own team. Several hosting providers decided to take their systems offline as a precaution. Although certain temporary measures could potentially reduce the risk, they did not provide sufficient assurance of protection against the vulnerabilities at that time.

We therefore made a conscious decision not to rely on temporary solutions whose actual effectiveness could not yet be adequately established. Following extensive internal consultation and coordination with several clients, we and our hosting partner chose to isolate our hosting environment as a precaution.

In making this decision, we carefully considered both service continuity and the security risks. Given the severity of the situation and the information available at the time, we considered this the most responsible precaution.

The emergence of these vulnerabilities and the timing of security updates from external software vendors were beyond our direct control. Our measures were intended to minimise the risks throughout this exceptional situation.

Timeline of our measures

Why did recovery take longer on some servers?

Our infrastructure consists of several software environments, including CloudLinux. Although the official PHP security updates became available during the afternoon, the required updates for certain CloudLinux environments were not yet available. In addition, the repositories used to download security updates were under heavy load worldwide. Consequently, making updates available and installing them on some systems took longer than usual.

For these components, we depended on external software vendors and their distribution channels. Throughout the process, we closely monitored developments and assessed the appropriate and responsible measures for each environment. Our aim remained to restore services as quickly as possible without taking unnecessary security risks.

Current status

The required security updates have now been installed and all services are available again. If you still experience any problems with your website or email, please contact us at support@surlinio.com. We will of course be happy to help.

In closing

We understand that the temporary unavailability of our services may have caused inconvenience and appreciate your patience during this exceptional situation. The decision to isolate our hosting environment as a precaution was made carefully, based on the information and security options available at the time. We stand by this preventive decision.

We would also particularly like to thank all clients who expressed their understanding, support and appreciation by email, social media or telephone during this situation. We greatly appreciated these messages.

Kind regards,
Surlinio