2026-10-21 11:15 PM ET – Plesk has provided updates that patch the vulnerable PHP versions. Those updates have now been installed. Hosted websites and services that use PHP are once again available.

2026-10-21 2:00 AM ET – On October 20, 2026, details of two critical remote code execution (RCE) vulnerabilities in PHP, leaked online before their coordinated disclosure and before patches were released. These vulnerabilities are identified by CVE-2026-109618 and CVE-2026-109619. Emergency patches, to the PHP software, are forthcoming.

A Remote Code Execution (RCE) vulnerability means that an attacker can take over an affected server.

PHP is used by many websites, and is required for websites that run WordPress and similar content management systems (CMS).

These vulnerabilities affect Widomaker’s Plesk server that provides website hosting to customers, as well as Widomaker’s own websites and weblog. Additionally, many website contact forms, including Widomaker’s own website contact forms, are PHP based and will be affected.

Due to the extreme severity of this vulnerability, and in order to avoid a full server compromise/breach, we plan to follow the advice of experts and isolate PHP, and the hosted websites that use it, from the Internet. This means that many of the websites we are hosting will go down until the PHP foundation and Plesk provide the necessary updates that will again allow running PHP, publicly on the Internet, safely. This could take several days. Some of Widomaker’s own websites will be affected.

Widomaker’s online ticketing system uses PHP, so that may not be available until updates are made available to us.

Furthermore, older versions of PHP (prior to version 8.2), that are no longer supported by the PHP foundation, may not receive a patch or update to fix the vulnerability. In that case, those web hosting customers who are using older unsupported versions may need to update their websites to use a supported version of PHP before their websites can go online again.

We apologize for the interruption in web hosting service, however, this critical vulnerability requires that we take these steps to protect our server and our customers’ data.

Updates, when available, may be found on our website (on an as available basis), our Facebook page, and our Status Page.

During this time, please try to avoid contacting us unless it is absolutely necessary and urgent, as we will be focusing our limited resources on following the progress of available updates and patches, and installing them once available. If you do need to reach us, email us using our helpdesk address found on our contact page.