Resolved (18:40 UTC — Oct 21)
SolusVM have released a patched version that we have now deployed to our management node.
As a result, we are confident to restore the full functionality of our virtual servers platform.
If you find any issues following the restoration, please get in touch.
Update (14:40 UTC — Oct 21)
The PHP team have released a patch to correct this vulnerability and wer are working to implement it.
Due to the embedded nature of some of PHP in these services, they may require us to wait for an upstream patch before we can update our systems.
As a precautionary measure, we have temporarily taken our SolusVM management node offline. SolusVM uses PHP and could be affected by the upcoming critical PHP security release, which is scheduled for Wednesday 21 October 2026 at 14:00 UTC (15:00 BST).
Existing virtual servers continue to run normally. However, no configuration changes can be made until the management node is restored.
In exceptional circumstances, we can shut down virtual machines if this is required for incident response. Please call +44 333 1127 999.
There is no evidence of compromise. We will restore the management node once we have confirmed that it is running a patched version of PHP.