More information: If you have a Managed Server or a Web Hosting Package that is online, you can download it with a patched and updated PHP version. If your chosen PHP version is not changed, it will also affect your own version. There is no unpatched (CVE-2026-109618 and CVE-2026-109619) PHP version online.
Important note: If your Managed Server or Webhosting package is back online, it is running a patched and secured PHP version. Even if the PHP version displayed to you is unchanged, it is in any case a version patched by us. No unpatched (CVE-2026-109618 and CVE-2026-109619) PHP version is online on our Managed Servers and Webhosting packages.
Update 23:45 CEST: All Web Hosting Packages (including Reseller) and all Managed Servers have been patched, secured and online. Since the Web Hosting Control Panel (WCP) remains offline: Since the verification of the Web Hosting Control Panel (WCP) has been confirmed, the Patch of the repairers will remain open until further notice. Our websites and e-mails have not been affected by this. However, the evaluation of the WCP is not possible. After completing the patch, we can play with it and watch the WCP online. Thank you for your patience.
Update 23:45 CEST: All Webhosting packages (including Reseller) and all Managed Servers have been patched and secured and are online. Only the Webhosting Control Panel (WCP) remains offline as a precaution: the final verification showed that an additional patch from the vendor Plesk is required, which has not yet been released. Your websites and emails are not affected. Only management via the WCP is temporarily unavailable. Once Plesk provides the patch, we will apply it and bring the WCP back online. Thank you for your patience.
Update 22:51 CEST: The rollout of security updates has been canceled. All Web Hosting Packages (including Reseller) as well as all Managed Servers have been patched, removed and moved online. The update of the Web Hosting Control Panels (WCP) is currently in progress and will soon be verified in the online version. There are only a few special features regarding Web Hosting and Managed Servers that are not included in the manual work.
Update 22:51 CEST: The rollout of the security updates is complete. All Webhosting packages (including Reseller) as well as all Managed Servers have been patched and secured and are back online. The update of the Webhosting Control Panel (WCP) is complete and will be brought online shortly after a final verification. A small number of special cases in Webhosting and Managed Servers are currently being finalized manually.
Update 22:02 CEST: Beim Webhosting since around 85% of the websites are online. The Plesk Updates for the Web Hosting Control Panel (WCP) have been 90% successful and have been collected online. Both of the Managed Servers have no need for a single system or letzte Nacharbeiten, which we want to abschließen from Schritt für Schritt.
Update 22:02 CEST: For Webhosting, around 85% of websites are back online. The Plesk updates for the Webhosting Control Panel (WCP) are around 90% complete and will be brought online together. For Managed Servers, a few individual systems still require some final adjustments, which we are completing step by step.
Update 21:02 CEST: The rollout on the Managed Server has been canceled. All Managed Servers have been patched, updated and updated online. Beim Webhosting since around 60% of the websites have been patched, deleted and viewed online.
Update 21:02 CEST: The rollout to the Managed Servers is complete. All Managed Servers have been patched and secured with all available PHP versions and are back online. For Webhosting, around 60% of websites have already been patched and secured and are back online.
Update 20:54 CEST: The Webmail is now patched, updated and online.
Update 20:54 CEST: Webmail has been patched and secured and is back online.
Update 20:47 CEST: The rollout includes both Web Hosting Servers with 45% and both Managed Servers with 85%. For the Web Hosting Control Panel (WCP) that Plesk updates are prepared, which are automatically rolled out.
Update 20:47 CEST: The rollout is at around 45% for Webhosting servers and around 85% for Managed Servers. Plesk has provided updates for the Webhosting Control Panel (WCP), which are currently being rolled out.
Update 20:33 CEST: The Rollout includes both Web Hosting Servers of 15% and both Managed Servers of 30%. All websites that are available online have been patched and deleted.
Update 20:33 CEST: The rollout is at around 15% for Webhosting servers and around 30% for Managed Servers. All websites that are already back online are patched and secured.
Update 19:59 CEST: The forum is now patched, closed and online. The Rollout of the Web Hosting Package will be available for your next follow-up, your own Web sites since they are available online, patched and deleted.
Update 19:59 CEST: Our forum has been patched and secured and is back online. The rollout to the Webhosting packages is progressing very well, and numerous websites are already back online, patched and secured.
Update 19:45 CEST: The Rollout launch. The Web hosting packages can now be written with the patched and deleted PHP versions online.
Update 19:45 CEST: The rollout is in progress. Web hosting packages are now coming back online step by step with the patched and secured PHP version.
Update 18:49 CEST: The tests of patched PHP versions were followed. We will start with the rollout with all web hosting nodes.
Update 18:49 CEST: The tests of the patched PHP versions were successful. We are now starting the rollout on all Webhosting nodes.
Update 18:07 CEST: The construction of patched PHP versions has been discontinued. We will start with the tests of the new versions, which will then start with the rollout of all affected systems.
Update 18:07 CEST: The build of the patched PHP versions is complete. We are now starting to test the new versions, and the rollout to all affected systems will begin immediately afterwards.
Update 17:44 CEST: The Customer Control Panel (CCP) and the CloudDNS API have now been patched, absolved and can now be updated. The patched PHP versions have been updated since 75% of the time.
Update 17:44 CEST: The Customer Control Panel (CCP) and the CloudDNS API have been patched and secured and are available to all customers again. Around 75% of the patched PHP versions for the remaining systems have been built.
Update 17:35 CEST: About 60% of the patched PHP versions have been successfully installed. We are testing the new versions and starting without any problems with the rollout on all affected systems.
Update 17:35 CEST: Around 60% of the patched PHP versions have already been built. We will then test the new versions and start the rollout to all affected systems immediately afterwards.
Update 16:59 CEST: We are currently working on the first patches. The PHP versions for our own web hosting packages are well known.
Update 16:59 CEST: We are already rolling out the first patches. The PHP versions for our web hosting packages are currently being built.
Update 16:25 CEST: The PHP updates have been released and we are ready to patch the system.
Update 16:25 CEST: The PHP updates have been released and we are currently patching our systems.
Dear customers,
in PHP, a software, with a large number of websites that are used, it is a very critical security solution. If you visit and interact with us, you will benefit from all the benefits of your Internet system. That is a pure health care measure. I have dated completely sincerely and since then.
Was it gerade nicht erreichbar?
The following information is available on the following system for the improvement:
- All Web Hosting Packages and Managed Servers available for web sites
- Customer Control Panel (CCP)
- Web Hosting Control Panel (WCP)
- Webmail
- Forum
- CloudDNS API
More information is available on the Server Control Panel (SCP). Root Server, VPS and Managed Cloud Cluster launch normally again.
Warum dieser Schritt?
The luck comes with the changes, the code for the systems to be developed. A security update is not yet possible. So long as you have the system with PHP capabilities, you can access the Internet. We will be happy to provide you with all Web Hosting Packages and Managed Servers available. If you are not aware, that is a more drastic decision. Since we have a great experience, our first experience is better than having a follow-up message on our website or our website. Zahlreiche Unternehmen und Behörden weltweit gehen derzeit genauso vor.
When is the system more accessible?
The security update of the PHP projects is currently available (21.10.2026, before 4:00 PM). Our teams continue to work and play with the update without delay after completion of all systems. We are aware of this, because the System is 3 bis 5 Stunden nach Veröffentlichung des Updates wieder erreichbar since, also voraussichtlich im Laufe des heutigen Abends. As a Webhosting or Managed-Server-Kunde müssen Sie selbst nichts tun.
Hints about being able to use Root Server, VPS or Managed Cloud Cluster when
using Server since they are not affected. The system is self-sufficient, and the security updates are included in the implementation, so that the PHP is set up. We are urgently required to ensure that the update is easy to install. The management of the server over the Server Control Panel (SCP) is more possible. Find more information on www.netcup-status.de.
What are the current status?
All new options can be found on our website: www.netcup-status.de
Technical Details
It deals with the security problems CVE-2026-109618 and CVE-2026-109619 (Schweregrad: critical, CVSS 9.2). Since then, all websites and applications that use PHP have been affected. You can find the official Vorankündigung des PHP-Projekts here: https://www.php.net/archive/2026.php#2026-10-20-1
Thank you for your understanding.
Ihr netcup Team
Dear customers,
A very critical security vulnerability has been found in PHP, a software that powers a large share of all websites worldwide. To protect you and your data, we have disconnected all potentially affected systems from the internet as a precaution. This is purely a preventive measure. Your data remains fully intact and is not at risk.
What is currently unavailable?
At the moment, the following systems, among others, are not available:
- All Webhosting packages and Managed Servers, including the websites hosted on them
- Customer Control Panel (CCP)
- Web Hosting Control Panel (WCP)
- Webmail
- Forum
- CloudDNS API
The Server Control Panel (SCP) remains available. Root Servers, VPS and Managed Cloud Clusters continue to operate normally.
Why did we take this step?
The vulnerability allows attackers to execute malicious code on affected systems. A security update is not yet available. Until it is, every system running PHP is potentially vulnerable as soon as it can be reached from the internet. This is why we decided to also take all Webhosting packages and Managed Servers offline temporarily. We are aware that this is a drastic step. However, we are convinced that a short interruption is better than a successful attack on your website or your data. Numerous companies and public authorities worldwide are currently taking the same approach.
When will the systems be available again?
The PHP project has announced the security update for this afternoon (21 October 2026, expected at 16:00 CEST). Our teams are ready and will apply the update on all systems immediately after its release. We expect the systems to be available again approximately 3 to 5 hours after the update is released, so most likely over the course of this evening. As a Webhosting or Managed Server customer, you do not need to do anything.
Notice for customers with Root Servers, VPS or Managed Cloud Clusters
Your servers are not affected by the shutdown. Since you manage these systems yourself, applying the security update is also your responsibility if you run PHP on them. We strongly recommend installing the update immediately after its release. You can continue to manage your servers via the Server Control Panel (SCP). Further information is available at www.netcup-status.de.
Where can I find the current status?
We will continuously publish all updates on our status page: www.netcup-status.de
Technical details
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 (severity: critical, CVSS 9.2). Potentially affected are all websites and applications that use PHP. The official advance notice from the PHP project is available here: https://www.php.net/archive/2026.php#2026-10-20-1
Thank you for your understanding.
Your net cup team