We have now applied the available Node.js security updates to managed customer servers and restarted applications using the replaced binaries. The latest audit found no outstanding package updates or processes using replaced binaries. This follows completion of the shared hosting rollout.

This does not yet address every affected Node.js installation. Some older, end-of-life versions and other vendor-provided packages still have no fixes available, and customer-installed copies require separate review. Customers using their own Node.js installations should check for security updates and move unsupported versions to a patched, supported release.

Our additional protection against Brotli-compressed requests remains in place, but is not a complete substitute for patched software. This incident remains open whilst we continue to monitor and await further releases from upstream.

PHP security patching is complete across Web Hosting, Reseller Hosting, Business Hosting, Managed VPS and Managed WordPress (Onyx). We are now monitoring following the rollout. No action is required from customers for these security updates.

The phpMyAdmin database management tool on Onyx remains temporarily unavailable. Its PHP update is complete, but the tool will remain offline while we move it to a new hosting environment. We are tracking this separately from the PHP security rollout and do not yet have a confirmed restoration time.

We appreciate your cooperation and patience over the psat 24 hours.

We are currently experiencing higher than usual support volumes due to the critical PHP (CVE-2026-109618 / CVE-2026-109619) and NodeJS vulnerabilities (CVE-2026-105483, CVE-2026-106069, CVE-2026-111497). Please see our other status updates for further details on those.

We appreciate your patience and hope to get back to our usual prompt response times as soon as possible.

As part of our ongoing mitigations against the recent critical PHP security releases, PHPMyAdmin for Managed WordPress (Onyx) has been temporarily taken offline to ensure its ongoing stability and the security of customer databases.

The instance itself has been patched against the security issues. Our team are using this time to ensure that it is configured optimally.

We do not currently have an ETA on when PHPMyAdmin will become available again, but we shall keep this updated as progress happens. As a rough idea of the timeline, it is likely that PHPMyAdmin for Managed WordPress (Onyx) will not be available until the first half of next week.

Thank you for your understanding.