On 21 October 2026, the German Federal Office for Information Security (BSI) issued a warning: all versions of the widely used programming language PHP contain a security vulnerability that makes websites vulnerable. Repair patches for the vulnerability have been released at the same time for PHP versions from PHP 7 onwards.

The problem also affects websites built with the Joomla content management system. However, the solution lies with the hosting providers, who must install the security patches — our part is to check whether this has been done and, if necessary, to update outdated PHP versions to a current release.

Many providers publish status updates, for example at https://status.alfahosting.de or https://status.df.eu/.

Others publish the latest information on their homepage or in their FAQs. So far, I have checked Mittwald, All-Inkl, domainfactory, webgo and IONOS.

All of them responded overnight and installed the security patches or at least provided special protection. That is good news.
The websites of my customers I controlled did not show any suspicious behaviour.

Conclusion: It is advisable to keep an eye on security
and to keep your own website technically up to date.