We took eventplanner.net offline this morning. Deliberately, as a precaution, and knowing everything we know now, we would make exactly the same call again. Everything is running normally once more, and you can pick up exactly where you left off.
If you visited during those hours, you saw our message explaining that we had taken the site down due to a critical security issue affecting a technology used across the web. That was the short version, written while our team was busy fixing it. Now that we are back, here is the full story in plain language.
What happened
Almost every website in the world is built on top of a small number of shared building blocks. One of those is called PHP. You have never had to think about it, and you shouldn't have to, but it is the engine running underneath a very large part of the internet: banks, webshops, news sites and a lot of the software our own industry uses every day.
Yesterday evening the team that looks after PHP did something they almost never do. They warned the world that two serious security problems had been found, that the repair would be published the following afternoon, and that everyone should get ready to install it the moment it appeared. What they deliberately did not say was what the problems actually were.
They had good reason to keep quiet. These were the worst kind of flaw: they let a complete outsider take control of a server without needing a username, a password or an account of any kind.
But the warning created an uncomfortable gap of roughly a day. The whole world now knew that a way in existed, while the repair did not exist yet. That is an open invitation, and people took it. Criminals hunted for the flaw, found it, and the first real attacks on websites were reported in the early hours of this morning, before anyone could install a fix.
Why we went offline
So this morning there was a known way into servers like ours and nothing yet to install against it. That is a gap you cannot close with cleverness. There is no setting to change, no extra lock to fit and no amount of monitoring that reliably stops an attack nobody has seen the shape of yet. The only thing that works with certainty is not being reachable at all.
So that is what we did. We closed the door, kept it closed until the official repair was published, and used the time to prepare and test the update so we could install it the second it landed.
This is not a decision we take lightly
In 25 years of eventplanner.net, this is the first time we have had downtime like this. We know exactly what a maintenance page costs. At any hour of the day, there are organisers using the platform for events that are happening right then. Doors opening. Guest lists being checked at the entrance. A call sheet open on a laptop backstage, crew ticking off their tasks, a budget being updated while a supplier waits on the phone. Taking the site offline is not an abstract technical decision for us. We know whose day we are interrupting.
We weighed that against the alternative, and it was not a close call. On one side, a few hours of real but temporary inconvenience. On the other hand, the possibility of a stranger gaining access to a platform that holds your guest lists, your budgets, your supplier agreements, and the personal details of your attendees. The risk was simply too high, and that is not a risk we get to take on your behalf.
So we chose the inconvenience. We would choose it again.
Why we could act so fast
Our team followed this from the moment the first warning appeared. We worked out which of our systems were affected, prepared the update, tested it and had everything standing ready before the repair even existed.
In the end, it was published earlier than announced. Because we were ready, our servers were updated within fifteen minutes, checked, and back online.
That speed is not luck. It is what you get from investing in serious, enterprise-grade technology with proper automation, rather than a handful of servers that someone updates by hand. It is the kind of investment you never see as a user and never think about, right up until the day it is the only thing that matters. Today was that day.
What this means for you
Nothing, and that is the whole point. There is nothing for you to update, change or reset. Your data, your events and your settings are exactly as you left them.
We are sorry for the interruption and grateful for your patience today. Quite a few of you worked out what was going on from the maintenance page, and more than a few of you were dealing with exactly the same emergency on your own website this morning. Our thoughts are with every IT team still working on this tonight.
Now, back to your events.
Source: Photo: created with AI assistance
