Important Security Notice: Server updates rolling out today (21/10)
From the Journal – Posted 21.10.2026, Updated 21.10.2026
Reading time – 2 minutes
UPDATE: 13:52
When sites are taken offline, depending on which hosting partner we're hosting your site with, you may see a maintenance message or you may just see an error accessing the site. This is unavoidable to ensure we can focus our efforts on getting everything patched and re-released as quickly as possible.
Taking the sites offline during remediation is following the NCSC guidance.
--------------
UPDATE: 12:45pm
We will be recommending all clients take their sites offline during the most vulnerable period of this potential attack, approximately between 2pm and 6pm this afternoon. This gives us a period of time to apply the relevant patches, and bring all sites back up securely and without risk
--------------
UPDATE: 11:52am
We have received note from one of our hosting suppliers that media uploads have been temporarily blocked during this period of vulnerability.
Due to the PHP critical vulnerability due to be disclosed today we have blocked all multipart upload requests on all projects and on servd.host.
This will create 403 errors for image and other file uploads. We are working on restoring normal functionality, however due to the critical nature and trivial exploitation of the bug, this is the safest course of action for the time being.
--------------
UPDATE: 11:45am
We have temporarily taken all staging sites offline to ensure we can focus our attentions on patching and securing all production websites.
--------------
We are writing to let you know about an important security update that our team will be deploying across our hosting servers, starting this afternoon.
What is happening?
Earlier today, the maintainers of PHP, the foundational software engine powering millions of websites worldwide (approximately 68% of the internet), including yours, announced a critical security update to address a newly discovered vulnerability.
While full technical details remain under embargo until the official release at 3:00 PM BST, immediate patching is standard best practice to keep web applications protected as soon as fixes become public.
What we are doing
Right now, our team is auditing PHP versions across all client websites we manage to determine which sites can be updated directly and which may require extra configuration.
We are actively monitoring the release and will begin testing and applying the security patches across our hosting environment starting at 3:00 PM BST today.
What this means for your website
Once we have completed our audit we will be in touch again to let you know what this means for your website. We will also be updating this page as we know more.
Links
