Most systems have been patched overnight and there is minimal impact to services ongoing. We are continuing to identify andnnotify clients running systems we consider may be impacted.
Posted Oct 22, 2026 - 08:27 AEDT
Investigating
We are aware of the widely reported PHP security vulnerability (CVE-2026-109618 / CVE-2026-109619).
Where we are aware of systems that are running potential impacted versions of PHP:
- we are applying vendor/WAF rule mitigations for current known exploits - we are restricting IP access where this is not possible to prevent exploit - we have confirmed that web hosting services are receiving protection through our partnership with CloudLinux and the Immunify360 services we run.
In some cases, we have also taken the proactive step to temporarily disable web services on systems in line with the current practice by several organisations. This is typically on systems where the current version of PHP is not supported, and is not likely to receive patch updates and will require further action to resolve.
We anticipate most services will be restored early morning Sydney time (it will take some time for the updates to be released, applied and tested, and systems to be cleared).
Posted Oct 21, 2026 - 23:46 AEDT
This incident affects: Hosting and Data Centre (Virtual Machine Hosting, Web Hosting).