Maintenance ended

CloudLinux has released the patched PHP versions, and we have applied them across all of our infrastructure.

Over the coming hours we’ll continue running checks and audits to confirm everything is working as expected. The ModSecurity rules and other mitigations will stay in place as an extra layer of protection while we do this.

No action is needed on your part. If you notice anything unusual with your website, please contact our support team.

Thank you for your patience while we waited for the fix.

CloudLinux has now released the patched PHP versions and we are deploying across our fleet.

PLEASE NOTE the patched PHP versions have the SAME VERSION NUMBER at the vulnerable versions. You can verify whether you are running the patched version by checking the build date, which should be 21st October.

We are still waiting for CloudLinux to release patched PHP versions.

In the meantime, customer websites remain protected. We’ve deployed ModSecurity rules that block known exploit attempts, along with additional mitigations.

We share your frustration at how long this patch is taking, and we’ll be raising it with CloudLinux so future issues are addressed more quickly.

You can follow CloudLinux’s latest updates here: https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5

We will post another update as soon as the patches are available and applied.

On servers where upstream patched packages have not yet been published by Cloudlinux, we have deployed additional ModSecurity rules to further mitigate against this issue. We continue to monitor this to ensure patches are deployed as soon as they are published.

We have been informed by Cloudlinux that the ETA for patches is before 8pm UK time. Currently all available mitigations are in place and we are exploring avenues to ensure patches are deployed ASAP.

We are over 50% of the way through patching all systems.

At this stage we are still waiting on patches to be published by Cloudlinux upstream, affecting shared cPanel-based servers.

We will provide a further update once this has been deployed.

We have clearly defined procedures and scripts in place to update all servers when the patches are released upstream after 3pm UK time. This includes:

• Zume Platform services
• cPanel-based hosting (Website, Reseller, Business, Managed WP)
• Enhance control panel based websites
• Zume's own control panels
• Managed Dedicated Servers with cPanel
• Managed VPS with cPanel or Enhance (WordPress Containers)

The patch will cover ALL PHP versions, including EOL versions.

If you are using any of the following services, you will NOT automatically recieve a patch and MUST take independent action:
- Cloud Servers
- Dedicated Servers
- Managed VPS Servers where YOU MAINTAIN THE ROOT ACCESS and therefore rely on Zume for REACTIVE TECHNICAL SUPPORT ONLY

Please get in touch if you have any questions regarding the upcoming patches.

We're aware of upcoming PHP security releases. As a precaution, we've deployed a preliminary mitigation across shared and managed hosting. Once the official patches are released upstream, we will deploy them as soon as possible. You don't need to take any action, and we'll update this notice once patching is complete.