Precautionary maintenance following critical PHP vulnerabilities
On 21 October 2026, two critical vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, were disclosed. Under certain conditions they may allow unauthenticated remote code execution.
What we have done
We immediately inventoried and reviewed every system available to us. Customer websites hosted through Nobody Workz web hosting have already been updated to the fixed PHP versions 8.4.27 and 8.3.36 and remain safely online.
Services for which the vendor has not yet released a patched build have been taken offline as a precaution. This currently affects web-based database management, the Nobody Workz game-server management and the web-hosting administration interface. The game servers themselves are not being reported as offline. However, because the required Nobody Workz game-server management is offline as a precaution, game-server management features in the customer portal are currently unavailable. Customer websites, databases and our other unaffected services remain available.
We currently have no substantiated indication of a successful attack, data leakage or lasting damage. These measures are strictly precautionary and protect our infrastructure and customer data.
We are continuously monitoring vendor releases. As soon as patched builds are available, we will test and deploy them and restore the affected services only after verifying the patch level. We will notify everyone again through our website, Discord and email.
We apologise for the inconvenience. The root cause is outside our control; prioritising security over short-term availability is our deliberate decision.
Important sources
Update — 22 October 2026
Secured vendor images are now available for web-based database management and Nobody Workz game-server management. We deployed them and technically verified their PHP versions: web-based database management is running PHP 8.3.36, and Nobody Workz game-server management is running PHP 8.5.12. Both services are available again, including game-server management features in the customer portal.
The web-hosting administration interface initially remained disabled as a precaution until its internal PHP runtime was demonstrably on a fixed release. Already updated Nobody Workz customer websites remain online.
Final update — 23 October 2026
The internal runtime of our web-hosting administration has now also received the official security update and has been upgraded to PHP 8.4.27. We verified the complete patch level directly on the system, then started the administration interface in a controlled manner and successfully tested it both internally and publicly.
This means all Nobody Workz services that were restricted as a precaution are available again. The website, customer portal, web-based database management, game-server management, web-hosting administration and associated customer websites are operating normally.
Our final review still found no substantiated evidence of a successful attack, data leakage or lasting damage. The precautionary security maintenance is now complete. Thank you for your understanding.
Resolved: 23 October 2026, 16:12 CEST