Security advisory · Guide
Frequently asked questions
Answers to the questions we get most about this advisory.
In het Nederlands: Veelgestelde vragen
Gebruikt u PHP, ga er dan van uit dat u getroffen bent tot u het heeft gecontroleerd. Waar PeaceWeb PHP beheert, patchen wij het; uw eigen cloudserver patcht u zelf. Websites die we offline hadden gehaald, zijn weer online en er zijn geen gegevens gewijzigd. Inloggen, bestellen en wijzigingen doorvoeren kan voorlopig nog niet. Wij vragen nooit om uw wachtwoord of betaalgegevens per e-mail of telefoon.
About the vulnerability
- Am I affected?
- If you use PHP in any form, assume so until you have checked. The guide Am I affected? explains how.
- I run PHP 8.1 or older. What now?
- These versions may not receive an official fix. Upgrade to a supported version, and keep the system offline or behind a VPN or IP allow list until then.
- Can I fix this in my website's code?
- No. The fix has to be applied to PHP itself. A web application firewall can help as an extra layer, but does not replace patching.
About PeaceWeb
- What does PeaceWeb do for me?
- Where we manage PHP for you, we patch it as the updates become available, starting with systems that are reachable from the internet. Active mitigations with our partners are in place across the PeaceWeb network.
- I manage my own cloud server. Does PeaceWeb patch it?
- No. On servers where you manage the software, you are responsible for PHP. Follow the guides Patch PHP and Limit exposure.
- My website was offline. Did I lose data?
- No. We only switched off incoming traffic and did not change the content or data of your website. All customer websites are back online.
- When can I sign in again?
- The customer portal, hosting management and virtualisation management stay closed until the remaining updates are installed. We reopen them in phases and announce it on the security advisory.
- Can I order or change my services in the meantime?
- Not for now. Need something urgently? Email support@peaceweb.com with "Urgent" in the subject.
Staying safe
- How do I recognise phishing about this incident?
- We never ask for your password or payment details by email or phone, and we don't send attachments about this advisory. In doubt whether a message is from us? Go to peaceweb.com yourself instead of clicking a link.
- Where can I follow updates?
- On the security advisory and on status.peaceweb.com.
Need help?
Email support@peaceweb.com from the email address of your account, with "Urgent" in the subject if it can't wait. Response times may be longer than usual.
Email support