Who had the update in place first?
For 2 days we followed the hosts' status pages and measured ourselves on the websites we look after. Each bar starts at 16:00, when PHP released the update, and ends where, according to the host, it was in place on all servers.
Hostpoint was far ahead, 90 minutes after the release. We checked this ourselves in the evening on several servers, each PHP version separately, since each one gets its own fix. hosttech and Infomaniak followed during the night.
cyon took the opposite route and switched PHP off before the update was even out. Every website there was offline overnight, but nothing was open to attack during that time.
Where it took longer
At 3 well-known hosts it took until well into Thursday. What the chart does not show is how they got there.
- METANET An announcement came on Wednesday at 10:30, then no update until Thursday morning.
- green.ch The platform was switched over first, overnight, the patches only followed afterwards.
- Webland By Thursday afternoon PHP 8.2 to 8.4 were fixed. For older versions Webland recommends switching.
Switch off or keep running?
The canton of Basel-Stadt chose to switch off on Wednesday evening. A crisis team took the parts of the cantonal websites that run on PHP offline, and from the night onwards they came back step by step. The universities of Basel and Geneva, EPFL and jobs.ch were also temporarily offline as a precaution.
Switch off
Safe immediately, but offline. PHP off means every website on the server is gone, including contact forms and shops.
Keep running
Reachable until the update is in, but open to attack in the meantime. Then every hour until the update counts.
Both are defensible. What matters is that someone decides deliberately instead of simply waiting.
How the flaw became known
The flaw (CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10) was already circulating before the update. Germany's BSI expected it to be exploited widely within a few hours, and CERT-EU recommended taking publicly reachable applications offline until the update.
What we did
- 08:30 start after the CERT-EU warning
- 170+ websites reviewed
- 21:10 own servers patched
- 17.10. how far back we checked the log files
At 16:30 we decided to take every website without the update offline or put it behind a password. We informed the affected clients directly by email.
Overnight, AI agents kept watch for us. They read the status pages continuously, checked every website we look after and examined the servers for traces of an attack. By morning there was a status for every website, and we checked every blocked website individually before it went back online.
People made the decisions. AI stayed awake.
What you can do now
- Ask your host When exactly was the update running on your server? The times above refer to completion on all servers.
- Check your PHP version You will find it in the hosting panel or in WordPress under «Tools › Site Health › Info › Server». The flaw is closed from 8.5.12, 8.4.27, 8.3.36 and 8.2.35. At hosts using CloudLinux, such as cyon and METANET, the number stays the same, there the host's notice counts.
- Replace old versions PHP 8.1 and older no longer gets new releases from the PHP project, only emergency fixes to build in yourself. How Swiss hosts handle old versions is covered in our comparison of PHP versions.
- Watch for traces Unknown administrators, changed pages or odd redirects are warning signs. If you notice anything, get in touch with us.
Sources
- Amazon Threat Intelligence, AWS Security Blog, 21.10.2026
- PHP, security release announcement, 21.10.2026
- Tenable, frequently asked questions about php2shell
- CERT-EU, Security Advisory 2026-018
- BSI, press release, 21.10.2026
- 20 Minuten, 21.10.2026
- SRF News, 21.10.2026
- Basler Zeitung on the canton of Basel-Stadt
- W3Techs, usage of PHP (share of websites whose programming language is known)
- Status pages of Hostpoint, cyon, Infomaniak, hosttech, green.ch, METANET and Webland, as of 22.10.2026 18:13
