Is Fluccs down?

The PHP security team has announced a security release addressing two critical vulnerabilities, each rated 9.2 out of 10. The release is scheduled for 1 am Thursday 22 October 2026, Sydney/Melbourne time, but may be published earlier. Our team will review the advisory on release and apply relevant patches to our managed hosting environments. Any required maintenance or service interruptions will be communicated through this status page. Affected PHP versions, technical details and fixed versions will be published with the release. Official PHP announcement can be viewed here https://www.php.net/archive/2026.php#2026-10-20-1

**PHP security update — 22 October 2026** We have applied emergency mitigations to our share hosting and managed server environments while we await the corresponding vendor patches. Our team continues to monitor vendor releases and will apply security updates as they become available. PHP has confirmed that **CVE-2026-109618 and CVE-2026-109619** can allow remote code execution without authentication. Fixes have been released in **PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12**. Temporary mitigations reduce exposure but do not provide complete protection. Installing the security updates remains necessary. **Shared hosting and managed server customers:** Our team manages server-level security updates. We strongly encourage customers using **PHP 8.1 or earlier** to move to a supported, patched version. Your website developer may need to update your website, plugins or themes to ensure compatibility before switching PHP versions. Please contact support if you need guidance. **Unmanaged server customers:** You or your appointed administrator are responsible for assessing your server, applying the appropriate updates and completing any required service restarts. If you use older PHP versions through an extended-support vendor, please confirm that its packages include fixes for both vulnerabilities. Updating your website or CMS alone does not address these vulnerabilities. We will provide a further update as patching progresses. [Official PHP security advisory](https://www.php.net/archive/2026.php)

**PHP security update — shared hosting patching complete** We have completed the installation of vendor security updates across our shared hosting and reseller servers to address **CVE-2026-109618 and CVE-2026-109619**, following the emergency mitigations applied earlier. Shared hosting customers do not need to install these server-level updates. We continue to recommend that customers using **PHP 8.1 or earlier** work with their website developer to move to a supported PHP version. The team are continuing to work through our Managed Server clients to apply the recently released vendor updates. **Unmanaged server customers:** You or your appointed administrator remain responsible for checking and updating your server. Completion of our shared hosting updates does not apply to unmanaged services. If you experience any issues with your hosting service, please open a support ticket.

Critical PHP security vulnerabilities (PHP2Shell) All shared hosting servers are fully patched against both PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). All cPanel managed servers are also fully patched. We are working through the remaining Managed Servers to apply vendor updates. If you run your own unmanaged server, please make sure you’ve updated PHP. Or reach out to our support team if you have any questions or need assistance. If your site uses PHP 7.2 to 8.1, we still strongly recommend upgrading to a newer version. We’ll contact affected customers over the coming days with more information.

Resolved: Critical PHP security vulnerabilities (PHP2Shell) All vendor security updates that can be applied, have now been applied across our servers. All shared hosting and cPanel managed servers are fully patched against both PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). We have two remaining managed servers unable to receive vendor patches at present. Both are still protected by a temporary fix we applied and we're contacting those customers directly about next steps and monitoring them closely. If you run your own unmanaged server, please make sure you've updated PHP. This incident is now resolved. If you have any questions, please open a support ticket and our team will be happy to help.

We would like to inform you that few services for bolt-community-101.myownserver.net server are not responding We are investigating and resbooting the server

The server and all its services are back online

Incident Summary: An unexpected issue was introduced following an automatic system update, which temporarily impacted incoming and outgoing mail services across our servers. Current Status & Resolution: Our technical team identified the root cause and applied a fix. All core mail services have been restored to full operational status, and normal message processing has resumed. Mail Backlog Notice: While the underlying issue is resolved, a backlog of messages built up during the service disruption. Our mail servers are actively processing this queue, but it may take 1–2 hours for all pending incoming and outgoing emails to clear and arrive in your inbox. No further action is required on your part. We sincerely apologise for the inconvenience this caused and appreciate your patience while the mail queue catches up.