Resolved -
This incident is now resolved. We have applied security patches for the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and implemented the recommended configuration mitigation for CVE-2026-115560. Normal service has been restored.
Thank you for your patience while our team worked to protect your websites and restore normal service.
Oct 23, 14:19 MDT
Monitoring -
The PHP security patches and associated server upgrades have been deployed across our hosting environment. We are now validating the updates and closely monitoring website availability and functionality.
Our team is continuing to troubleshoot any issues that arise and make configuration adjustments as needed following the upgrades. This incident will remain in Monitoring while we complete these checks, and we will provide further updates as needed.
Oct 22, 14:52 MDT
Identified -
We are responding to newly disclosed PHP security vulnerabilities and implementing additional protections across our hosting platform.
Beginning this afternoon, October 21, some websites will temporarily display a 503 Service Unavailable message while we route their traffic through our web application firewall (WAF). This is a precautionary measure while we complete the PHP security updates.
If your website displays this message, we will contact you with instructions needed to restore access.
We recognize the disruption this causes and are working to restore affected websites as quickly as possible. We will post further updates here.
Oct 21, 15:52 MDT
