Out of an abundance of caution we are selectively shutting down all of our public web sites in response to a severe PHP RCE that was going to be disclosed tomorrow morning. Unfortunately, it looks like there are already functional proof-of-concept exploits for the two problems in the wild. This includes webmail, forums, membertools, sonic.com, as well as ancillary other services, including sonicstatus.com. We will work on restoring all of these services as quickly as possible once this fixes become available tomorrow or we are confident that we’re able to use local mitigations to close the exploit paths.
For more information, see https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
-Kelsey, and the rest of the Sonic System Department
Update Wed Oct 21 09:46:46 PDT 2026: PHP released their fixed versions this morning and we’ve been working on rolling out the updates as quickly as possible to restore all affected services. We expect that all disabled systems except for members.sonic.net to be back online in the next hour. -Kelsey
Update Wed Oct 21 10:42:42 PDT 2026: All disabled systems except for members.sonic.net are back online, members.sonic.net relies on a version of php which has not been patched yet. -Kelsey
Update Wed Oct 21 12:15:02 PDT 2026: All disabled systems except for members.sonic.net are back online for real this time, webmail had been fixed but the static maintenance page was accidentally left in place. -Kelsey