Status: Investigating impact The PHP project has published an informational advisory about a further vulnerability (CVE-2026-115560). It is a potential remote code execution vector in PHP’s session handling. The PHP project rates it as unlikely to occur in practice, because it requires an unusual combination of configuration and application code. We are aware of the advisory and are currently investigating the impact on our products and customers. To be on the safe side, we recommend that customers apply the mitigation recommended by the PHP project now: set session.upload_progress.enabled=0 in your PHP configuration and restart PHP. If you already applied this setting following the PHP advisory of 21 October 2026 (CVE-2026-109619), no further action is needed. A full fix will follow in the next regular PHP release. We also continue to recommend updating to the fixed PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (the fixes for the 21 October advisory). We will update this notice as soon as we have more information. How to apply the mitigation Self-managed servers (VPS/VDS/Dedicated, no control panel) Edit the relevant php.ini (or a conf.d override) and set session.upload_progress.enabled = 0. Restart PHP-FPM or Apache (e.g. systemctl restart php8.x-fpm or systemctl restart apache2). Check with php -i | grep upload_progress or a phpinfo() page. Set this in php.ini or the FPM pool/server config. The PHP project advises against relying on ini_set() or .user.ini, because the setting must apply before request parsing. cPanel/WHM In WHM, go to Software → MultiPHP INI Editor. Choose the PHP version and open Editor Mode. Add or set session.upload_progress.enabled = 0 and save. Repeat for every installed PHP version. Restart PHP-FPM if the change is not applied automatically. Customers without WHM access can use cPanel’s MultiPHP INI Editor per domain. Server-wide configuration by the administrator is preferred, see the note below. Plesk Server-wide: Tools & Settings → PHP Settings, select the PHP version, and add session.upload_progress.enabled=0 under Additional configuration directives (or edit the php.ini tab). Per subscription: Websites & Domains → [domain] → PHP Settings, add the same line under Additional configuration directives, then click Apply. Repeat for every PHP version in use.

0 minutes

The mitigation (session.upload_progress.enabled=0) is implemented on all our webspace systems.

14.10.2026 Object Storage is functioning normally in EU and US, this incident now only affects the APAC region Object Storage. Additionally, customers in Sydney might experience slower data transfer speeds at times. The cause is a broken submarine cable between Australia and Singapore. Repairs are currently expected in November, though this timeline may change. We’re mitigating the situation by rerouting traffic. While we resolve the situation, automated backups will continue as bandwidth and performance allows, and backup status remains visible via the CCP (Customer Control Panel). 23.09.2026 We are continuing to address performance issues affecting our Object Storage cluster. As a precaution, automated backups remain paused. Existing backups are unaffected and restores continue to operate normally. We will provide a further update once resolved. ----------------------------------------------------------------------------------------------------------------------------- We are currently addressing performance issues affecting our Object Storage cluster. The Object Storage product remains fully functional. As a precaution, automated backups to this cluster have been temporarily paused. Existing backups are unaffected, and restores continue to operate normally. A fix is already underway. We expect the cluster to be fully operational within the next few days and are closely monitoring progress. Once resolved, automated backups will resume, and backup status will remain visible via the CCP (Customer Control Panel) throughout. We will provide further updates as they become available.

900 minutes