Maintenance ended

Dear customer,

PHP has announced an emergency security release for two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2). The fix is scheduled for release today, Wednesday 21 October, at 14:00 UTC (16:00 CEST). No workaround is available until then, and the affected code paths have not been published.

We have been monitoring the situation since early this morning and have seen no signs of exploitation anywhere on our infrastructure. Even so, we are not willing to leave critical systems exposed on an unpatched runtime while the details are still unknown.

What we are doing

As a precaution, we are taking the following PHP-based services offline until the patch has been installed:

• Client area and billing portal (billing, invoices, orders, support tickets)
• Game panel (panel.wasabihosting.com)
• Any other internal services that run on PHP

What keeps running

• All game servers, VPS, dedicated servers and web hosting accounts remain fully online. This is a shutdown of our management portals only, not of your services.
• Our network, DDoS protection and monitoring are unaffected.
• The main website, wasabihosting.com, stays available.

Timeline

• Now: billing portal and other PHP-based services are offline
• 16:00 CEST (14:00 UTC): PHP releases the fix
• Directly after: we install the update, verify it and bring the services back online

We will send a follow-up email once everything is back and you can log in again. If PHP delays the release, we will let you know.

Need us in the meantime?

Support tickets are not reachable while the client area is down, so please contact us via:

• Discord: our community server (support channels are staffed as usual)
• Email: hello@wasabihosting.com

If you run your own PHP applications on a VPS, dedicated server or web hosting account with us, we strongly recommend updating PHP as soon as your distribution ships the patched packages (expected as 8.5.12, 8.4.27, 8.3.36 and 8.2.35). Older branches such as 8.1 and below are end of life and will not receive a fix. If you are still on one of those, now is the time to upgrade or to place the application behind a firewall or VPN.

More background: https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

We apologise for the inconvenience and appreciate your understanding. Taking the portals down for a few hours is a far better outcome than dealing with a compromise.