Why addy.io went offline for the PHP2Shell vulnerability

October 21, 2026 • updates

Today I took the addy.io website and the web app offline because of a critical PHP vulnerability known as PHP2Shell. Both are back online. Email delivery continued throughout.

Updates were posted on the status page.

What is PHP2Shell?

PHP2Shell is the public name for two flaws in PHP, CVE-2026-109618 and CVE-2026-109619. They affect web servers that run PHP. Someone who can reach the server over the web may be able to run their own code on it.

The PHP project published fixes today. Until a server is running a patched version of PHP, a public PHP website is exposed.

Why the site went offline

addy.io's website and web app both run on PHP. The safe step was to take those web systems offline until the patched PHP version was installed. Leaving them up would have left them open to attack.

Email delivery does not depend on those web pages. Forwarding continued as normal. You could still receive mail at your aliases while the website and web app were down. You could not log in, change settings, or use the API during that time.

Timeline

All times are BST on 21 October 2026.

12:07 - The website and the web app were taken offline.
15:18 - The website was back online.
15:33 - The web app was back online after the patched PHP version was installed.

The full notes are on the status page.

If you self-host

If you run your own addy.io server, update PHP to a patched release. The fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Restart PHP after the update.

I am sorry for the interruption. The outage was the fastest way to keep the service safe until the fix was available.

Feedback and suggestions