On October 21, 2026, InvisHosting was offline for most of the day. That was our decision, not an outage and not an attack. This briefing explains what happened, what we did, and what it means for you.
What happened
Early that morning, details of two critical vulnerabilities in PHP became public before an official fix was available. PHP is the programming language InvisHosting runs on, along with a large part of the web. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 (nicknamed "php2shell"), and together they allow remote code execution: a specially crafted request to a vulnerable website can make its server run an attacker's code.
Until a patch existed, every PHP website was exposed. We were not willing to keep InvisHosting running on a known-vulnerable foundation while we waited.
What we did
- We put the site into maintenance mode and turned off uploads, downloads and sign-ins.
- We stopped every PHP process on our servers, so the vulnerable code was not running at all and there was nothing left to attack.
- We checked our servers for any sign of exploitation: modified or unexpected files, unknown processes, new accounts and suspicious scheduled tasks. We found none.
- We installed the official security update once it was released, and verified it was in place before bringing anything back online.
We also used the downtime to harden our server setup further: we retired an old server control panel and tightened the configuration around the site and our mail servers.
Is my data safe?
Yes. Our review found no evidence that these vulnerabilities were used against InvisHosting, and no sign that any files, accounts or other data were accessed. Your uploads, links and account are exactly as you left them, and you do not need to do anything.
We shut down early precisely so that it would stay that way. Taking the site offline protected your data at the cost of a few hours of availability, and that is a trade we will make every time.
Timeline (UTC)
- 06:59 — InvisHosting enters maintenance mode; uploads, downloads and sign-ins are switched off.
- 09:12 — All PHP on our servers is stopped and blocked from restarting.
- 16:47 — The patched PHP release is installed and verified.
- 17:33 — InvisHosting is back online.
Our commitment
Privacy is the product, and security is the promise. That line is on our Security page, and this is what it looks like in practice: when your data could be at risk, we would rather be offline for a few hours than take a chance.
If you ever notice anything that looks wrong, write to us at [email protected]. We read every message.