Skip to main content
Jigsaw Logo

The PHP Blackout of 2026 – Server Status

  • admin
  • October 23rd, 2026
  • No Comments

This has been an interesting week in tech. Mostly down to AIs being taught how to hack.

The hot issue: PHP,  the most common server-side programming language on the internet, had 2 big security holes in it. Those holes meant someone could drive a truck through your server, pull customer data, trade data, all that good stuff that usually only government and bank servers keep giving away to hackers.

And the nerds at php.net handled it just how you think a nerd would - badly. Instead of keeping their big fat mouths shut they announced to the world that a patch to V8 would be available the next day at 2pm UTC time. That was basically an invitation for every hacker on the planet to find it. Hackers are nerds too, so hours before the 2pm UTC time, some idiot released the details, not because he was being nefarious.


No, he did it for likes.

He didn't get many likes, though and he probably needs to get new social media accounts. Nerds were NOT happy.

Anyway, the moment that was public, I had no choice but to take all of our servers down. We do not keep your credit card numbers but we have your names, emails, addresses and of course, your trade data,

Now, a few questions I've been asked:

  • How did daytradr still work when the license server was dead? That's mostly because we built daytradr to be robust and a licensing server being down should not stop you using the app. It will eventually, but the platform has 'licensing wiggle room' for this type of scenario. Something a vibe coded app would not do. Any trades that didn't make it to Journalytix during downtime will be sent when you connect.
  • Why didn't more websites go down? Mostly because nobody was paying attention. Partly because I have a friend who spent time on the wrong side of cyber-security.
  • Are we doomed? No, we survived Brexit. GFC, Covid - this is closer to Y2K fever.  Capitalism will figure it out. We just need to make sure the government gets out of it.

Obviously, more of this kind of thing is going to happen. At Jigsaw, our policy is

  • If in doubt, switch it off.
  • If a server gets infected, we destroy it.

Now, that last one might sound severe, but we lease servers off AWS, so no actual server gets hurt. But recently, when we were building our new site. I forgot to protect it, it got attacked and we trashed it. Once you get attacked, it's very hard to trust the server. We also run immunify on our servers.

Anyway, this will happen again. What I would do immediately

  • Change your password on any prop firm/broker accounts you have.
  • Reach out to your prop firm/broker and ask them if they were exposed to recent exploits (PHP, node.js, Linux), if you need to do anything.

If you get vague answers or "we are ok" - I'd run for the hills. Right now, every company with a server should be right on top of it and able to reply that maybe they don't use the tech, which is fine - but they should also understand that all tech is under attack and you need to know they have a guy or service provided on top of it.

And also, we already got a conspiracy theory. The CIA put the backdoors into these apps and that's what's being found.