On 21 October 2026, a serious security flaw was found in PHP, the software that runs most of the world’s websites. For several hours, we blocked parts of our systems to keep our customers safe while a fix was released. In this article, we’ll explain what happened, who was affected, what we did and what, if anything, you need to do now.
What is PHP?
PHP is the software that powers most websites, including every WordPress site. When someone visits a website, PHP builds the page they see. It also runs online systems like our client area at my.tasjeel.ae.
Because it’s so widely used, a weakness in PHP affects millions of websites at once – not just one company.
What was the problem?
The PHP team announced two flaws that let an attacker take control of a web server. They didn’t need a password or a login. They only had to send a specially made request to a website.
From there, an attacker could:
- change or delete websites
- plant harmful code that infects visitors
- steal data stored on the server
Security experts rated the flaws 9.2 out of 10 for severity. An attack tool was shared publicly soon afterwards, so the risk was real and immediate.
What we did, and why
The attack worked through forms and file uploads. So, while the fix was being prepared, we took two steps:
- We blocked forms and file uploads on the websites we host. Contact forms, order forms and uploads on our customers’ websites may not have worked during this time.
- We paused our ticket system. Customers couldn’t open or reply to tickets, and our team couldn’t reply either. Live chat and WhatsApp stayed open throughout.
We worked through the night with CloudLinux, the company that supplies the security systems on our servers. The fix came out in stages, one PHP version at a time, and we applied each one as soon as it was ready. By the early morning of 22 October, every server was updated, and forms, uploads and tickets were working normally again.
We know a few hours without forms or tickets was inconvenient, and we’re sorry for that. That said, we’re confident it was the right call. Pausing forms for a few hours is a small price compared with a website being taken over.
Was I affected?
It depends on what you have with us.
- You host a website with us: your website’s forms and uploads may not have worked for several hours on 21 October. Messages sent through your contact form in that time may not have reached you. Please see “What should I do now?” below.
- You only have domains with us: your domains, and any website or email linked to them, kept working as normal. The only effect was that you couldn’t contact us by ticket for a few hours. You don’t need to do anything.
- You have email hosting only: your email kept working as normal. You don’t need to do anything.
What should I do now?
If you host a website with us, there’s one simple step we recommend: make sure your website runs a current PHP version.
The newest PHP versions were fixed first. Older versions took much longer, because the PHP project no longer supports them. Running a current version is one of the best ways to stay protected next time.
To check and change your PHP version:
- Log in to your client area at my.tasjeel.ae.
- Open your hosting service and click Log in to cPanel.
- In cPanel, under Software, click Select PHP Version.
- Choose PHP 8.3 or PHP 8.4, and click Set as current.
Tip: before you switch, update your website’s themes and plugins. Very old ones may not work with newer PHP. If anything looks wrong afterwards, you can switch back the same way. Our full guide is here: Change your PHP version.
Not sure what to pick? Our team can check your site and make the change with you. Just get in touch on live chat or WhatsApp.
Questions you might have
Could this happen again?
It might. PHP runs most of the web, so people look for weaknesses in it all the time. Flaws this serious are rare, but they do happen. If one appears, we’ll act quickly again – and keeping your website on a current PHP version means you’ll be protected sooner.
Some of my visitors couldn’t send a form. What should I do?
If you expected enquiries on 21 October, it’s worth checking with anyone who may have tried to contact you through your website that day.
Do my backups cover this?
Yes. We back up websites on our hosting twice a day and keep them for 30 days. If you ever need an earlier copy of your site, see Back up and restore your website.
I got an email asking me to update PHP through a link. Is it from you?
No. News like this is often followed by fake emails. You can only change your PHP version yourself, inside cPanel. We will never send you a link to do it, and we will never ask for your password. Always type my.tasjeel.ae into your browser yourself. If an email seems wrong, don’t click anything, and forward it to our support team.
Here to help
Keeping your website safe is part of what you pay us for, and on 21 October that meant acting fast. If you have any questions about this update, or would like a hand changing your PHP version, our team is ready to help on live chat, WhatsApp or by ticket.
