In this article
Yesterday, the PHP development team announced two critical security vulnerabilities affecting PHP, one of the world's most widely used web programming languages.
Security patches are expected to be released today, 21 October 2026, at 2:00 PM UTC (3:00 PM UK time).
As several of Kinetic Hosting's core systems rely on PHP, we've been monitoring this situation very closely. Initially, we had hoped to keep our services online until the security patches became available. However, as we've got closer to the scheduled release, more information about these vulnerabilities and how they could potentially be exploited has started circulating publicly.
With this in mind, we've made the decision to temporarily take our PHP-based services offline, effective immediately.
This means that:
The Kinetic billing panel will be temporarily unavailable.
The Kinetic game panel will be temporarily unavailable.
Our team will begin restoring these services once the security patches have been released, applied, and verified.
We understand that this is inconvenient, particularly for customers who need to manage their services.
However, protecting your servers, personal information, and our infrastructure is our highest priority. We believe temporarily taking these systems offline is the safest and most responsible decision while we wait for the security updates.
We want to make it absolutely clear that we currently have no evidence of Kinetic Hosting's systems being compromised. This downtime is entirely precautionary.
We also want to stress that this is not a vulnerability specific to Kinetic Hosting. It is a security issue within PHP itself, affecting software used by websites, applications, and companies around the world.
What Is PHP?
PHP is a programming language that has been around for more than 30 years. It's used to power the behind-the-scenes functionality of millions of websites and online services. When you log into a website, manage an account, or interact with an online service, there's a good chance PHP is involved somewhere behind the scenes.
In fact, PHP is used by around 70% of websites where the server-side programming language is known.
Some well-known software built using PHP includes:
WordPress: One of the world's most popular website-building platforms.
MediaWiki: The software behind Wikipedia.
Pterodactyl: The game server management software that many hosting providers use, including systems that Kinetic has built upon.
This is why security vulnerabilities within PHP can potentially affect so many different companies and services.
What Is This Security Vulnerability? Does It Only Affect Kinetic?
No. This is a wider security issue affecting PHP, not a security flaw introduced by Kinetic Hosting. The PHP development team has identified two critical vulnerabilities within the language itself.
A security vulnerability is essentially a weakness in software that could potentially allow someone to do something they shouldn't be able to do. Depending on how a vulnerability works, this could include accessing information, interfering with services, or running malicious instructions on a server. Because PHP is used so widely, the potential impact extends far beyond Kinetic Hosting.
It doesn't necessarily mean every website running PHP is vulnerable. The exact affected versions and circumstances will be confirmed alongside the security updates.
Why Is Kinetic Offline While Other Websites Are Still Working?
Different companies have different ways of responding to security threats.
Some businesses may have additional protections in place, while others may decide that the risk of remaining online is acceptable until a security patch becomes available.
At Kinetic, we've decided to take a more cautious approach.
As more technical information about these vulnerabilities has become public, the potential risk of someone exploiting them before the patches are available has increased. Rather than take that risk with systems responsible for managing your servers and account information, we've chosen to temporarily disable the affected services.
We would much rather explain a few hours of precautionary downtime than risk a security incident that could have been prevented.
Our priority has always been to keep your services and information safe, even when that means making difficult decisions like this.
What Makes These Vulnerabilities Different From Normal Security Updates?
Software receives security updates all the time. Most are relatively minor, and many can be fixed through routine updates without any noticeable disruption.
However, some vulnerabilities are considerably more serious. Security vulnerabilities are often assigned a unique identifier called a CVE (Common Vulnerabilities and Exposures), allowing developers and security researchers to track them.
They can also receive a severity rating using a system called CVSS, which scores vulnerabilities from 0 to 10.
To put that into perspective:
0–3.9: Low severity
4.0–6.9: Medium severity
7.0–8.9: High severity
9.0–10.0: Critical severity
Both of the newly announced PHP vulnerabilities have received a severity score of 9.2 out of 10, placing them firmly in the critical category.
This is an unusually serious security announcement, especially given how widely PHP is used. It's also important to understand that a critical vulnerability doesn't automatically mean a system has been hacked. It means there is a potentially serious weakness that needs to be addressed.
Has Any Customer Information Been Compromised?
At this time, we have no evidence that Kinetic Hosting's systems or customer information have been compromised.
Our decision to temporarily take services offline is a preventative measure, not a response to a confirmed security breach. We will continue monitoring the situation and reviewing our infrastructure as the security updates become available.
When Will Everything Be Back Online?
The PHP security updates are currently scheduled for release at 2:00 PM UTC (3:00 PM UK time) today, 21 October 2026.
Once released, our team will begin applying the necessary updates and verifying that our systems are secure and functioning correctly.
We'll restore access to the billing and game panels as soon as those checks are complete. Please understand that 2:00 PM UTC is the expected patch release time, not a guaranteed time for our services to return. We'll provide further updates as we make progress.
Further Information
For customers who run their own PHP-based websites or applications, or who would simply like to understand the situation in more detail, you can find additional information below:
Official PHP Security Announcement: https://www.php.net/archive/2026.php#2026-10-20-1
PHP Community Discussion: https://www.reddit.com/r/PHP/comments/1xb2utu/upcoming_critical_php_security_release/
If you manage your own PHP applications, we strongly recommend checking for security updates when they're released.
Thank you for your patience and understanding
We know unexpected downtime is frustrating, and taking our own systems offline is never a decision we make lightly.
However, we'd rather be overly cautious than put your information or services at unnecessary risk.
Keeping Kinetic Hosting and our customers secure will always come first.
Thanks!
Chris
CEO @ Kinetic Hosting
