Xenius NOC

Alle omgevingen zijn terug beschikbaar. We volgen deze vulnerabilities de volgende uren en dagen verder op.

Heeft u nog vragen mbt. deze vulnerability, aarzel dan zeker niet om ons te contacteren via support(at)xenius.be

Onze shared omgeving is volledig up-to-date, voor oudere PHP versies werden de nodige backports en/of mitigaties voorzien.

De verwachting is dat uiterlijk 23u alle systemen terug beschikbaar zijn.

Most websites are back online and accessible.

The rollout of the mitigations has been completed, and server patching is well underway. Most websites are back online, and we are currently working through the remaining monitoring alerts.

If your website is still offline, please contact our team immediately. We are exceptionally available by phone until 22:00 this evening. Over the next few hours, we will also complete the server patching. All currently supported PHP versions will receive an update. You do not need to take any action yourself.

If you are using an older PHP version, you remain protected by the mitigations we have implemented. For now, this protection appears to be sufficient. We continue to actively test the proof-of-concept exploits in our environments to verify the effectiveness of our measures.

We will continue working hard over the next few hours to get everyone safely back online. We will, of course, keep you informed of further progress.

The fixes for both PHP issues are now available. Our team is currently testing them and rolling them out across all our systems.

Over the past few hours, we have already taken precautionary measures. We will bring your websites back online as soon as we have verified that the fixes work correctly and the vulnerabilities have been resolved. This thorough verification takes time, but the security of your websites comes first.

Please bear with us a little longer. Better safe than sorry! Next update around 18:00.

PHP has announced an emergency security release for today at 16:00 CEST. It fixes two critical vulnerabilities in PHP (CVSS 9.2) that could let an attacker take over a server remotely, without logging in. Exploit code is already circulating online, so we expect attacks soon after the details are published.

What we’re doing

• From 15:30 CEST we’re taking all hosted websites offline as a precaution.
• Meanwhile we’re installing the official PHP security update and applying extra protection on every server.
• We bring each site back online as soon as its server is patched and checked. We’ll post updates in this channel.

What this means for you

• Your website will be unreachable for a while, roughly until the patch is installed and checked.
• Your email and other services that don’t run on PHP keep working as normal.

Want to keep your website online?

Reply to this message before 15:30 CEST and include your domain name(s). We’ll leave your site running. Please note that it may then be exposed to these vulnerabilities until it’s patched, and that the risk is yours. We’ll still patch it as quickly as possible.

If you have questions, reply here or contact our support team.