PHP and Brotli Flaws Fixed
You may have read about it in the news: in October, several serious security vulnerabilities became known within just a few days, in software that a large share of all websites worldwide rely on. News like this sounds alarming, and many people wonder: is my website affected too?
The short answer: no, you are protected. We have closed all three vulnerabilities on our hosting servers, each one on the very day it became known. If you have web hosting with us, you do not need to do anything.
Security vulnerability: A flaw in a program that lets unauthorised people do something that should not be possible. Think of a window that can be opened from outside even though it looks closed.
Patch (update): The fix for such a flaw. To stay with the image: a new lock for the window. “Patched” means the fix is installed and the window is secure again.
CVE: Short for “Common Vulnerabilities and Exposures”. Every publicly known vulnerability is given a unique number worldwide, for example CVE-2026-109618. It works like a case number, so all vendors and hosting providers know exactly which flaw is meant.
PHP: The programming language that most websites run on, for example every site built with WordPress, Joomla or Shopware. PHP runs on the server; your visitors never see it.
Brotli: A method of making data smaller so it can be transferred faster. Similar to a ZIP file, just invisible in the background.
The three vulnerabilities at a glance
PHP2Shell: secured on the same day
On 21 October, a particularly dangerous vulnerability in PHP was published under the name “PHP2Shell”. It was so dangerous mainly because ready-made attack instructions appeared on the internet at the same time. We therefore shielded our servers within a few hours and then updated all PHP versions to a corrected release.
In case you noticed anything that day: as a protective measure, uploading files to websites and logging in to Plesk (your management interface) were restricted for a few hours. Since 22 October, everything has been working as usual again.
A note for websites on older PHP versions (5.6 to 8.1): the PHP developers no longer provide fixes for these versions. To keep your website secure anyway, these versions now run on a release that continues to receive security updates. Nothing changes for you; only the name of the PHP version in Plesk may look slightly different. If you are working on your website anyway, switching to PHP 8.3 or newer is worthwhile.
Upload indicator switched off as a precaution
Two days later, on 23 October, a second flaw in PHP became known. It sits in a small, rarely used extra feature that can report how far a file upload has progressed. There is no fix for this flaw yet, so we simply switched this extra feature off.
Uploading files itself works completely normally. Almost all websites display their progress bar in a different way anyway and will not notice anything. As soon as the fix is released, we will switch the feature back on.
Brotli: everything updated
On 26 October, a vulnerability in Brotli followed, the method for making data smaller. Ordinary websites built with WordPress and the like were hardly affected; it mainly concerned web applications programmed with Node.js or .NET. We updated all affected programs on our servers. In addition, our servers reject suspicious requests packed with Brotli. A normal browser never sends anything like that, so your visitors will not notice a thing.
Only if you run your own web application: very old versions (Node.js 21 and earlier, .NET 7 and earlier) are no longer maintained by their vendors and will not receive a fix. In that case, please switch your application to a current version in Plesk.
Your own server? Then it’s up to you
If you have your own server with us (a root server or virtual server), you manage it yourself. You should install the latest updates there. Would you rather leave this to us? Then open a ticket for your server in the customer area at https://admin.firestorm.ch and choose the “Upgrade” tile. This service is chargeable; you will see the cost directly when creating the ticket.
We keep watching
We check new security advisories continuously and automatically, around the clock. If a vulnerability becomes known that could affect your website, we act immediately. That way you can take care of your business while we take care of security.
