Is Servers Australia down?

Since late last night, we have been experiencing intermittent disruptions to our S3 Object Storage service, which may result in requests timing out or failing. The issue is occurring as our storage cluster continues to recover and rebalance data following a storage disk (OSD) failure. Our team has been working around the clock to maintain service stability and minimise disruptions. We have engaged our hardware vendor's support team and are continuing to investigate the underlying cause and work towards a permanent resolution. We are actively monitoring the service and taking steps to restore access when disruptions occur. We will provide further updates as our investigation progresses.

We have made significant progress in restoring stability to our S3 Object Storage service. The storage issue identified as the primary cause of the intermittent disruptions has now been resolved, and the affected portion of the storage cluster has returned to normal operation. The cluster is continuing to recover from the earlier disk failure, and some background recovery operations remain ongoing. Our team is closely monitoring service performance and working with our hardware vendor to address the remaining recovery and capacity concerns. While we expect service stability to improve following this recovery, we are continuing to monitor for further disruptions before considering the incident fully resolved. We will provide further updates as the situation progresses.

Servers Australia is continuing to respond to two recently disclosed critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which affect PHP installations across multiple operating systems and hosting environments. Our teams are actively monitoring security advisories and patch releases from PHP, cPanel, CloudLinux, Ubuntu and other relevant vendors, and applying updates to customer servers covered by a Servers Australia Monitoring and Maintenance Agreement (MMA). This status page will serve as the central point of information for customers regarding the progress of security updates, outstanding vendor patches and any potential service impacts. ==== Current Security Update Progress ==== === cPanel – Non-CloudLinux Environments === Security updates have been applied to all applicable cPanel servers covered by an MMA that are not running CloudLinux OS. PHP 8.2, 8.3, 8.4 and 8.5 – Security updates applied. PHP 7.4, 8.0 and 8.1 – Backported security patches applied. === CloudLinux – ALT-PHP Environments === CloudLinux has now released security updates addressing the identified vulnerabilities for affected ALT-PHP versions across applicable operating systems. Our team is actively deploying these updates across managed customer environments and validating that the appropriate security patches have been successfully installed. === Ubuntu and Other PHP Environments === Our team is continuing to review and apply applicable security updates for other managed PHP environments, including Ubuntu-based servers, as the relevant vendors release and confirm their patches. ==== Expected Service Impact ==== As part of this security maintenance, we will be restarting Apache, PHP-FPM and LiteSpeed web services, where applicable, to ensure security updates take effect. These restarts may result in brief interruptions to website or application availability, typically lasting only a few seconds. We are working to minimise disruption while prioritising the security of affected customer environments. === Customer Action Required === No action is required from customers whose affected servers are covered by a Servers Australia MMA. Our teams are coordinating and applying the necessary updates. Customers who manage their own servers or PHP installations should review the applicable vendor security advisories and ensure relevant updates are applied as soon as possible. === Further Updates === We will continue to update this status page as additional security patches become available, outstanding updates are deployed, and our teams complete validation across the affected environments. Need Assistance? If you experience any issues with your website or hosted applications following this maintenance, please contact our Support Team by submitting a ticket through the Servers Australia Customer Portal. We appreciate your patience and understanding as we undertake this important security maintenance.

At this time, we are advising customers of important PHP security updates following the identification of two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities affect multiple PHP versions and may expose servers and hosted applications to security risks if left unpatched. ==== Customer Action Required ==== Customers without a Monitoring & Maintenance Agreement (MMA) are responsible for applying the required security updates to their servers. Servers Australia will not automatically apply these updates to self-managed, unmanaged or other hosting services that are not covered by an MMA. We strongly recommend reviewing your PHP installations and applying the necessary security updates as soon as possible. ==== Recommended Actions ==== === Update PHP to a Supported Version === Review all installed PHP versions and update them to the latest compatible security release. Where possible, we recommend upgrading to PHP 8.4 or PHP 8.5, provided your websites, applications and extensions support these versions. As of 22 October 2026, the minimum upstream PHP releases addressing these vulnerabilities are: PHP 8.2.35 PHP 8.3.36 PHP 8.4.27 PHP 8.5.12 === Apply Updates Across All PHP Installations === Ensure security updates are applied to all PHP installations, including PHP-FPM, command-line PHP, web server PHP handlers and associated extensions. For servers using cPanel or CloudLinux, apply the relevant vendor-provided security updates, including backported fixes where available. === Update Your Server Software === Apply available security updates to your operating system, hosting control panel (such as cPanel/WHM), web server and associated software. Ensure your server is running supported software versions. === Review Older PHP Versions === PHP 8.1 and older versions no longer receive security updates from the official PHP project. Some Linux distributions and long-term support (LTS) vendors may provide backported security fixes for these older versions. If you are using an unsupported PHP version, we recommend contacting your software vendor to confirm whether the required security fixes are available or upgrading to a currently supported PHP version. Due to the severity of these vulnerabilities, the PHP security team has also provided minimal source-level backports for: PHP 7.4: https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619 PHP 8.0: https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619 PHP 8.1: https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619 These fixes are intended to assist customers who build PHP from source or do not have access to security updates through an LTS vendor. Please note that these backports do not restore official support for older PHP versions. Upgrading to a supported version remains the recommended approach wherever possible. === Verify Your Websites and Applications === After applying updates, restart any affected services, such as Apache, PHP-FPM or LiteSpeed, as required. Confirm your websites and applications are functioning correctly and that the relevant security fixes have been applied. We also recommend ensuring current backups are available and reviewing server and website logs for unusual activity. ==== Need Assistance? ==== If you are unable to complete these updates yourself, the Servers Australia Support Team can assist. Please note: Security updates for non-MMA services will not be applied automatically. Customers are responsible for applying the updates or requesting assistance. Support requests are subject to your existing service agreement, and additional charges may apply. PHP upgrades may affect compatibility with older websites and applications. We recommend ensuring current backups are available before making changes. To request assistance, please submit a support ticket through the Servers Australia Customer Portal: https://mysau.com.au ==== Further Information ==== For additional information about these vulnerabilities, supported PHP versions and available security updates, please refer to the following official resources. Official PHP Website: https://www.php.net PHP Supported Versions: https://www.php.net/supported-versions.php The PHP Foundation – Today's PHP Security Release, and How We're Strengthening PHP Security: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ We encourage all affected customers to review their environments and apply the necessary updates promptly to help maintain the security of their services.

Following advice from our vendors, we are currently restarting web services for all managed MMA customers to ensure the latest security patches have been applied correctly. Affected customers may experience a brief interruption to web services of approximately 60–90 seconds during the restart process. Services are expected to return to normal automatically once the restart is complete. We also advise all unmanaged MMA customers to restart their Apache, LiteSpeed, PHP-FPM and Nginx services, where applicable, after applying the latest patches to ensure the updates take effect correctly. We will provide further updates as required.

We can confirm that the latest security patches have now been deployed, and web service restarts have been issued across all MMA-managed customer environments. These restarts were carried out to ensure the latest security updates have been applied correctly and are in effect. While these maintenance activities have been completed, we encourage customers to continue monitoring their websites, applications and operating systems for any unexpected behaviour and to ensure their environments remain up to date with the latest security patches. We will continue to monitor vendor security advisories and provide further updates or take additional action where required.

Critical PHP Security Vulnerabilities – Plesk Security Update The PHP project released security updates on 21 October 2026 addressing two vulnerabilities, both rated Critical. As Plesk includes and uses PHP, these vulnerabilities may affect Plesk installations. These vulnerabilities are within PHP itself and are not vulnerabilities in the Plesk application code. Identified Vulnerabilities: - CVE-2026-109618 - CVE-2026-109619 Affected and Patched Product Versions PHP on Plesk Obsidian for Linux PHP 8.5 Affected: 8.5.11 and below Patched: 8.5.12 PHP 8.4 Affected: 8.4.26 and below Patched: 8.4.27 PHP 8.3 Affected: 8.3.35 and below Patched: 8.3.36 PHP 8.2 Affected: 8.2.34 and below Patched: 8.2.35 PHP 8.1 (End of Life) Affected: 8.1.34 (built before 21 October 2026) Patched: 8.1.34 (built on 21 October 2026) PHP 8.0 (End of Life) Affected: 8.0.30 (built before 21 October 2026) Patched: 8.0.30 (built on 21 October 2026) PHP 7.4 (End of Life) Affected: 7.4.33 (built before 21 October 2026) Patched: 7.4.33 (built on 21 October 2026) PHP on Plesk Obsidian for Windows PHP 8.5 Affected: 8.5.11 and below Patched: 8.5.12 PHP 8.4 Affected: 8.4.26 and below Patched: 8.4.27 PHP 8.3 Affected: 8.3.35 and below Patched: 8.3.36 PHP 8.2 Affected: 8.2.34 and below Patched: 8.2.35 Plesk Obsidian – Internal PHP Engine Plesk for Linux (sw-engine component) Affected versions: - Plesk Obsidian 18.0.80 Update 10 and below - Plesk Obsidian 18.0.81 through Update 3 Patched versions: - Plesk Obsidian 18.0.80 Update 11 (18.0.80.11) - Plesk Obsidian 18.0.81 Update 4 (18.0.81.4) Plesk for Windows (plesk-engine component) Affected versions: - Plesk Obsidian 18.0.80 Update 10 and below - Plesk Obsidian 18.0.81 through Update 3 Patched versions: - Plesk Obsidian 18.0.80 Update 11 (18.0.80.11) - Plesk Obsidian 18.0.81 Update 4 (18.0.81.4) Action Required Customers operating Plesk servers are strongly encouraged to review their installed Plesk and PHP versions and apply the relevant security updates as soon as possible. To update your Plesk installation: 1. Log into your Plesk control panel. 2. Navigate to Tools & Settings > Updates and Upgrades. 3. Install the latest applicable Plesk updates, including version 18.0.80.11 or 18.0.81.4, depending on your installed release. 4. Verify your installed Plesk version under Tools & Settings > Server Components. 5. Review your installed PHP versions under Tools & Settings > PHP Settings. 6. Ensure all applicable PHP versions have been updated to the patched releases listed above. Important: For end-of-life PHP versions such as 7.4, 8.0 and 8.1, the PHP version number may remain unchanged after patching. The build date and installed package information should be checked to confirm the applicable security updates have been applied. Further Information For further details about these vulnerabilities and the available security updates, please refer to the official Plesk documentation: Plesk Security Advisory – CVE-2026-109618 and CVE-2026-109619 For guidance on viewing and managing PHP versions within Plesk, please refer to: Plesk Documentation – Configuring PHP Handlers We understand that applying security updates may require additional planning, particularly for environments running older PHP versions or applications. We appreciate your patience and cooperation as we work together to ensure the ongoing security of your services. For further updates, please continue to monitor Servers Australia's Status Page.