Our team has now applied the PHP security updates across the servers we manage, based on the information released so far.
We’re continuing to monitor our hosting platforms closely to make sure the updates are working as expected. If you notice anything unusual with your website, please contact our support team.
We’ll post a further update here if anything changes.
Posted Oct 21, 2026 - 18:53 BST
Update
PHP has now released fixes for the vulnerabilities, which have been confirmed as critical.
Our team is now working through our hosting platforms and updating PHP on every server we manage. Our existing security tools are already helping to protect websites while this happens, but applying the updates is the priority.
Some of this work may cause short periods of disruption to websites this afternoon. We’ll keep this to a minimum.
Websites not hosted by us: if your website is hosted outside of Netmatters, your hosting provider will need to apply these updates. We’d recommend contacting them to confirm they’re doing this. We will attempt to contact customers who are not hosted by us shortly.
Posted Oct 21, 2026 - 15:10 BST
Update
You may have seen media coverage today suggesting that website owners should update their websites or take them offline in response to this morning’s PHP vulnerability announcement. We want to give you a clearer picture of where things stand.
Full technical details of the vulnerability haven’t been released yet. We’re expecting further information from PHP at 3pm UK time today, and we’ll review it and act on it as soon as it’s available.
In the meantime, our hosting platforms already have a number of protections in place, including keeping websites separated from each other on the same server. In most cases, these should help protect against this kind of threat. Every website is different, so we can’t guarantee this for every site, but we’re monitoring closely and will apply patches as a priority once they’re released.
Should you take your website offline?
At this stage, we don’t believe most websites need to be taken offline. It’s also worth knowing that taking a website offline doesn’t necessarily make it safer, particularly on shared hosting, because the server itself is still running. If you’d still prefer to take your website offline as a precaution, please contact our support team and we’ll talk through the options with you.
We’ll post another update here once we’ve reviewed the information from PHP.
Posted Oct 21, 2026 - 14:34 BST
Identified
Following the official announcement of a security vulnerability affecting PHP, our team is actively reviewing all affected systems and preparing mitigation steps. Full details of the vulnerability are still emerging.
We already have a number of protective measures in place across our hosting platform, and we’re monitoring closely for any unusual activity. As soon as patches or official guidance are available, we’ll apply them as a priority.
To keep your services secure, we may need to carry out urgent maintenance this afternoon, which could cause some short periods of disruption. We’ll keep this to a minimum and post updates here as work progresses.
Posted Oct 21, 2026 - 11:02 BST
This incident affects: Shared Web/Email Hosting Platform, Sysflow Managed Platform, and Cloud Servers.