Update Thursday 22nd 10:30
All Blacknight control panels, shared hosting servers, and managed dedicated and VPS customers are now fully patched.
Please also be aware that some versions of PHP on our shared hosting plans are updated using backporting, so the specific php version will not change but the security patches are installed.
We have been rolling out an emergency workaround to a critical security vulnerability (php2shell) released overnight, which impacts any servers running php (all versions)
For more information lookup CVE-2026-109618 and CVE-2026-109619.
The mitigation we are rolling out is only a temporary workaround until vendors release the security patches (expected later today), and it may impact file uploads. It is currently being deployed to ….
New shared hosting (cp.blacknighthosting.com)
Cloud3 VPS (managed)
Dedicated servers with management
Legacy shared hosting (cp.blacknight.com)
Blacknight infrastructure
Where we have access we will deploy to unmanaged customers once the above have completed.
Vendor patches are being released for current versions only (8.3 upwards ) so we advise customers to consider upgrading the version of php and enable automatic updates where applicable if running WordPress , Plesk, cPanel etc.
Update 13:20: We have rolled out mitigations while waiting on the patches to be released (due 15:00 today) to the following customer platforms…
Sharedhosting (legacy and new)
Managed servers/VPS with control panels (Plesk/CPanel)
Please note: for legacy hosting one of the mitigations could break file uploads and some form submissions. This is a necessary measure to protect customers until the released patches have been applied. If you notice this issue on your website please bear with us as the mitigation will be reversed once patches have been tested and applied.
Update 16:35: We have confirmation that patches will be released for multiple versions of php including alt-php /ea-php (not just 8.x versions) but may not be available until after 19;00 pm.
Update 22:00: We are applying patches for all versions of PHP as they become available and mitigations remain in place.
Update 00:10: We have patched all servers now, Legacy Shared, New Shared (mega, giga, tera + wordpress plans), Control panel servers, managed and unmanaged servers, vps’s etc. Where we applied mitigations prior to the updated packages being available we’re leaving them in place for the moment and we’ll re-assess the situation tomorrow.
Update Thursday 22nd 07:10: We spent a number of hours after the last update finalising and checking that versions of php installed gave us coverage for the 2 CVEs mentioned above. There was mass confusion due to how Cloudlinux and Tuxcare pushed the updates for a while, but with their help we got all of our php instances patched across all platforms.
