A Global Cybersecurity Threat. A Critical Decision. How ThreeSixty Protected Its Clients.
As a major security vulnerability put websites worldwide at risk, ThreeSixty's engineering team made the difficult decision to prioritize protection over availability. Here's what happened and why it mattered.
Governments across the globe were taking websites offline. Major banks and airlines were suspending digital services. Even organizations responsible for critical internet infrastructure were temporarily shutting down systems.
The reason? A critical PHP security vulnerability had exposed millions of potentially vulnerable systems worldwide, triggering an urgent response from cybersecurity teams across industries and continents.
At ThreeSixty, our engineering team was seeing the threat firsthand. Our monitoring systems had detected automated attacks specifically targeting the vulnerability, and we faced a critical decision: Keep our customers' websites online while potentially exposing them to attack, or temporarily take them offline to implement additional protections.
As organizations around the world scrambled to address the threat, our engineers began the intensive process of evaluating servers, implementing emergency security measures and restoring websites as quickly and safely as possible.
Here's what happened, why we acted and what our response means for the businesses that trust us with their websites.
Understanding the PHP security vulnerability
PHP is a widely used programming language that supports the behind-the-scenes functionality of websites, including those built on platforms such as WordPress. A newly identified vulnerability exposed potentially serious security weaknesses in affected PHP environments. If successfully exploited, these weaknesses could allow attackers to execute unauthorized code, potentially compromising websites, applications and sensitive information. The threat was particularly concerning because automated tools could be used to identify and target vulnerable systems at scale.
This was not an isolated issue affecting ThreeSixty or its customers. It was a global cybersecurity event that required immediate attention from website administrators, hosting providers and security professionals.
A worldwide threat with widespread consequences
The scale of the threat was staggering. According to cybersecurity researchers at Palo Alto Networks Unit 42, more than 22.6 million internet-facing systems were potentially vulnerable to the newly discovered PHP security flaws. As attackers raced to exploit the vulnerabilities, organizations around the world scrambled to protect their systems. Governments across Europe and Asia, including Germany, France, Finland and Japan, took government websites and online services offline as a precaution. Canadian federal government websites were also affected.
The disruption extended well beyond government agencies. Parts of Wikipedia and the BBC were temporarily unavailable, while major banks and airlines in Japan suspended digital services. Even ICANN, an organization responsible for coordinating critical internet infrastructure, temporarily took several of its websites offline to implement security updates. The situation was serious enough that U.S. cybersecurity agencies urged organizations to take immediate action, including applying emergency patches and taking vulnerable systems offline when necessary.
This wasn't routine website maintenance. It was an urgent global security threat requiring difficult decisions and immediate action.
Why ThreeSixty took websites offline
As the global threat developed, ThreeSixty's proactive monitoring identified automated attack attempts specifically targeting the PHP vulnerability. Our engineering team recognized the seriousness of the situation and faced a difficult decision. We could keep our customers' websites online while attackers actively searched for vulnerabilities, potentially exposing businesses to unauthorized access, stolen data, compromised systems and significant operational disruptions. Or we could temporarily take those websites offline, giving our engineers the opportunity to assess the threat, strengthen security measures and restore services safely.
Neither option was without consequences. We knew that taking websites offline would disrupt businesses that rely on them every day. But the potential damage from a successful cyberattack could extend far beyond temporary downtime.
Ultimately, we chose to prioritize security over availability.
Our engineering team proactively took all ThreeSixty-hosted websites offline to evaluate each server individually, identify potential signs of exploitation and implement necessary protections before restoring service. This wasn't a response to a successful breach. It was a deliberate decision to act before one could occur.
Importantly, while our monitoring identified attempted attacks, our investigations found no indication of successful exploitation or compromise.
How our engineering team responded
While much of the world was working to understand and contain the threat, ThreeSixty's engineering team was already taking action behind the scenes. Over nearly 48 hours, our engineers worked to evaluate servers, implement emergency security upgrades and strengthen protections throughout our hosting infrastructure. It was a demanding process that required careful coordination, ongoing monitoring and individual assessments to ensure websites could be restored safely.
And the work involved much more than simply installing a software update. Our team reviewed servers for signs of exploitation, applied available security patches and implemented additional safeguards designed to limit unauthorized access. ThreeSixty's infrastructure also incorporates multiple layers of security, including content delivery network (CDN) and web application firewall (WAF) services, origin-level access restrictions and proactive monitoring. These protections provide additional safeguards beyond PHP updates alone.
As organizations around the world raced to secure their systems, increased demand placed additional strain on the systems distributing security patches. Our engineers continued working through these challenges, staying on top of developments and restoring websites as quickly and safely as possible. For our customers, much of this work happened out of sight. But behind every server assessment, security update and website restoration was a team making informed decisions to protect the businesses that depend on us.
Most websites have now been restored with protective measures in place. Some legacy and custom-built websites require more extensive remediation, and our team is working directly with affected customers to determine the safest and most appropriate path forward.
Website security requires an ongoing commitment
Cybersecurity threats will continue to evolve, particularly as artificial intelligence makes it possible to identify and exploit vulnerabilities more rapidly. Incidents like this also highlight a growing concern for businesses: Zero-day vulnerabilities, which are security weaknesses discovered before a fix is available, can leave even well-maintained websites exposed to unexpected threats.
While no hosting environment can eliminate every risk, proactive monitoring, layered security protections and experienced engineering oversight can make a meaningful difference in how quickly threats are identified and addressed.
At ThreeSixty, we take that responsibility seriously.
We appreciate our customers' patience and understanding throughout this process. Our engineering team continues working to complete the remaining remediation efforts while maintaining the security and integrity of our hosting environment. And while many of our customers were going about their daily business, our engineers were already working behind the scenes, identifying threats, making difficult decisions and taking action to protect the websites they depend on.
Because protecting your website isn't just about responding to the latest threat. It's about being prepared for the next one.
