News: PHP Vulnerability

Two critical security vulnerabilities were discovered in PHP (CVE-2026-109618 and CVE-2026-109619) that may allow remote code execution on a server. Details about them leaked before the official fix was released.

What we did

• We temporarily took the Game panel, dashboard and Web panel offline, along with related services, to protect your data and your services
• The official PHP fix was released at 16:00 CEST (14:00 UTC). We deployed it, tested everything and brought the services back online [DOPLNIT: date and time of restoration]
• On web hosting, we deployed the PHP update for your websites for you

Game servers and web hosting

Game servers and websites on our web hosting kept running without restrictions during the outage. Only logging in to the Game panel, dashboard and Web panel was unavailable. No action is needed on your side.

Information for VPS customers

You manage your VPS yourself, so updating PHP is up to you.

• Update PHP to the fixed version as soon as possible
• If you can't update right away, temporarily restrict access to the service from the internet
• Setting session.upload_progress.enabled = Off in php.ini does not protect against these vulnerabilities – this has been confirmed
• PHP 8.1 and older no longer receive official fixes. Please consider upgrading to a newer version

Security is our priority, and we'd rather choose a short outage than take any risk. Thank you for your understanding and patience.

If you don't have access to your VPS (for example via SSH) or get stuck, open a ticket and we'll help you.