Out of an abundance of caution are selectively shutting down all of our public web sites in response to a severe PHP RCE that was going to be disclosed tomorrow morning. Unfortunately, it looks like there are already functional proof-of-concept exploits for the two problems in the wild. This includes webmail, forums, membertools, sonic.com, as well as ancillary other services, including sonicstatus.com. We will work on restoring all of these services as quickly as possible once this fixes become available tomorrow or we are confident that we’re able to use local mitigations to close the exploit paths.
For more information, see https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
-Kelsey, and the rest of the Sonic System Department