Fluccs is currently experiencing a critical incident affecting Shared servers (Fluccs) and Shared servers (Exigent) and 1 more component, which began 11h ago. The vendor's full update timeline is below.
Affected components
Update timeline
- identified Oct 21, 2026, 06:02 AM UTC
The PHP security team has announced a security release addressing two critical vulnerabilities, each rated 9.2 out of 10. The release is scheduled for 1 am Thursday 22 October 2026, Sydney/Melbourne time, but may be published earlier. Our team will review the advisory on release and apply relevant patches to our managed hosting environments. Any required maintenance or service interruptions will be communicated through this status page. Affected PHP versions, technical details and fixed versions will be published with the release. Official PHP announcement can be viewed here https://www.php.net/archive/2026.php#2026-10-20-1
- identified Oct 21, 2026, 02:57 PM UTC
**PHP security update — 22 October 2026** We have applied emergency mitigations to our share hosting and managed server environments while we await the corresponding vendor patches. Our team continues to monitor vendor releases and will apply security updates as they become available. PHP has confirmed that **CVE-2026-109618 and CVE-2026-109619** can allow remote code execution without authentication. Fixes have been released in **PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12**. Temporary mitigations reduce exposure but do not provide complete protection. Installing the security updates remains necessary. **Shared hosting and managed server customers:** Our team manages server-level security updates. We strongly encourage customers using **PHP 8.1 or earlier** to move to a supported, patched version. Your website developer may need to update your website, plugins or themes to ensure compatibility before switching PHP versions. Please contact support if you need guidance. **Unmanaged server customers:** You or your appointed administrator are responsible for assessing your server, applying the appropriate updates and completing any required service restarts. If you use older PHP versions through an extended-support vendor, please confirm that its packages include fixes for both vulnerabilities. Updating your website or CMS alone does not address these vulnerabilities. We will provide a further update as patching progresses. [Official PHP security advisory](https://www.php.net/archive/2026.php)