PHP offline from today (wednesday) 15:45 Wednesday 21st October 2026 12:13:00

Due to a PHP security vulnerability, we will be disabling all PHP services on Uberspace shortly before the upcoming PHP release—at approximately 15:45. As a result, all WordPress and Nextcloud instances, along with any other PHP-based software, will go offline.

Once we have deployed a workaround or patch, we will bring the services back online after 16:00.

Details: https://www.heise.de/en/news/Critical-PHP-updates-on-Oct-21-fix-code-injection-vulnerabilities-11495177.html

U7: All PHP versions have been upgraded to the patched versions (8.2, 8.3, 8.4, 8.5).

Posted 5 hours ago by :username

U8: All available PHP versions are updated and PHP services have been reenabled. Temporary blocks of multipart/form-data POST have been removed.

U7: PHP 8.4 and 8.5 has been rolled out in current versions and services are being reenabled soon. PHP 8.3 and 8.2 will follow right after. Any users still on the EOL version 8.1 are force-updated to 8.2.

Posted 6 hours ago by :username

The PHP team published the new versions about 20 minutes earlier than announced. We immediately turned off PHP on all U7 and U8 asteroids. We are currently in the process of building the updated versions.

Posted 7 hours ago by :username

Based on information from https://github.com/syhunt/php2shell-protection, we have implemented a temporary mitigation rule that blocks HTTP POST requests with a content type of "multipart/form-data," as these are highly likely to be the primary attack vector. Typically, forms use "application/x-www-form-urlencoded" unless they involve file uploads; therefore, PHP applications should largely continue to function as normal, with only upload features being affected.

We will remove this rule once the PHP updates that properly address the vulnerability have been deployed.

Posted 10 hours ago by :username