DirectAdmin has created additional patches to update PHP 5.6 up to PHP 7.3. We have installed these patches this morning. With this addition, all PHP versions (PHP 5.6 up to 8.5) are now patched against this vulnerability.
Since all systems are now fully patched, this incident is resolved.
Posted Oct 22, 2026 - 10:41 CEST
Update
All DirectAdmin servers have also been updated.
The current status is: - All Project-managed servers have been updated (PHP 5.6 up to 8.5) - All Ansible-managed servers have been updated (PHP 5.6 up to 8.5) - All DirectAdmin-managed servers have been updated (PHP 7.4 up to 8.5)
For DirectAdmin, patches have been released for PHP 7.4+. There are currently no patches for PHP 7.3 and lower. This means these versions are still vulnerable. We expect these patches to arrive tomorrow.
Posted Oct 21, 2026 - 17:42 CEST
Update
Updates have also finished for our Ansible-managed servers.
DirectAdmin servers are still being updated. We will update the post as this progresses.
Posted Oct 21, 2026 - 16:59 CEST
Update
The updates have been installed on all our projects-managed servers.
We are still working on updates for our Ansible and DirectAdmin managed servers. Once these have been installed we will post another update.
Posted Oct 21, 2026 - 16:33 CEST
Update
The PHP package updates have been released in the repository. The package maintainers have also published updated packages for PHP5.6+. This means these versions will also receive a fix.
We will immediately install them on the servers and post another update once this process has been completed.
Posted Oct 21, 2026 - 16:00 CEST
Update
Between 10:30 - 11:30 we have applied a mitigation on all servers: The session.upload_progress.enabled directive has been set to Off.
We expect that this makes exploitation more difficult, but it does not fully resolve the issue.