InMotion Hosting incident
Security Maintenance: PHP Configuration Updates
InMotion Hosting is currently experiencing a minor incident, which began 23h ago. The vendor's full update timeline is below.
Update timeline
- identified Oct 21, 2026, 03:27 AM UTC
We are applying urgent security mitigations across our server infrastructure to address recently disclosed PHP security vulnerabilities (CVE-2026-109618 / CVE-2026-109619). As part of this update, we are disabling the default PHP session.upload_progress.enabled setting. While standard platforms (including WordPress) remain unaffected, custom non-WordPress sites relying on PHP native file upload progress tracking may experience functionality changes.
- identified Oct 21, 2026, 02:40 PM UTC
Our Systems Engineering and Security teams are actively deploying critical cPanel security updates to address the recently disclosed php2shell vulnerability across supported PHP versions. Current Deployment Status by Environment: **Dedicated Servers:** Resolved. Updates have been successfully applied across all dedicated server infrastructure. **VPS Containers:** In Progress. Security patches are currently being deployed across all virtual private servers. **Shared Hosting:** Monitoring & Preparing. We are awaiting the upstream security patch from CloudLinux for older PHP versions. Our engineering team is fully prepared to roll out cPanel updates across all shared hosting clusters immediately upon CloudLinux's release. You can follow upstream progress directly via the [CloudLinux Incident Status Page](https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5).
- identified Oct 21, 2026, 08:16 PM UTC
Our Systems Engineering and Security teams are continuing to deploy critical cPanel security updates to address the recently disclosed php2shell vulnerability across supported PHP versions. Current Deployment Status by Environment: Dedicated Servers: In Progress. Updates have been successfully applied across all dedicated server infrastructure. VPS Containers: In Progress. Security patches are currently being deployed across all virtual private servers. Shared Hosting: Monitoring & Preparing. We are awaiting the upstream security patch from CloudLinux for older PHP versions. Our engineering team is fully prepared to roll out cPanel updates across all shared hosting clusters immediately upon CloudLinux's release. More information is available at https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/ You can follow upstream progress directly via the CloudLinux Incident Status Page.
- investigating Oct 21, 2026, 10:21 PM UTC
As we continue to await official patches from CWP to mitigate the identified vulnerability we have determined the safest course of action at this time is to also restrict ports for CWP/CWP Admin as the panel itself utilizes PHP to function. Access to CWP and CWP Admin is possible if your IP address has been allowed in the firewall; Support can assist with this to restore your access. Webmail ports will remain open during this unplanned maintenance. There is no current estimate on when official patches will be provided, but as soon as those are distributed and applied and we can confirm and ensure the success of the updated patches we will revert the restrictions on the CWP/CWP Admin ports and function should return to normal.
- investigating Oct 21, 2026, 10:24 PM UTC
As we continue to await official patches from CWP to mitigate the identified vulnerability we have determined the safest course of action at this time is to restrict ports for CWP/CWP Admin as the panel itself utilizes PHP to function. Access to CWP and CWP Admin is possible if your IP address has been allowed in the firewall; Support can assist with this to restore your access. Webmail ports will remain open during this unplanned maintenance. There is no current estimate on when official patches will be provided, but as soon as those are distributed and applied and we can confirm and ensure the success of the updated patches we will revert the restrictions on the CWP/CWP Admin ports and function should return to normal.
- identified Oct 22, 2026, 01:02 AM UTC
PHP version upgrades are being committed and have already been performed across Shared and Dedicated servers. PHP version upgrades for the VPS fleets are currently being performed. There is still no estimate to when this will be complete, but as soon as everything is patched and deemed functioning safely we will lift any restrictions and update accordingly.