October 2026

All affected VPS instances are operational again. The incident is resolved.

The interruption lasted approximately 5 to 12 minutes depending on the virtual server, with slowdowns during the preceding quarter of an hour.

We apologize for the interruption to your services and the inconvenience caused.

The host server has restarted. The virtual machines are restarting automatically and progressively.

Services are becoming accessible again as the VPS instances start up. The incident remains open until all services have been restored.

The host server is restarting to restore the affected services.

Host server mrs1-compute027 has stopped responding. The VPS instances hosted on this server are temporarily unavailable.

We have been experiencing slowdowns since approximately 05:45 (Paris time) on host server mrs1-compute027 in Marseille. VPS instances hosted on this server may experience performance issues.

Maintenance is complete.

Maintenance has started as scheduled.

We inform you that a maintenance operation is scheduled on all clusters of our VPS ranges hosted at our Paris POP, in order to apply an urgent security patch (CVE-2026-99999).

Date:

• Thursday October 22: From 21:00 to 23:00

This maintenance campaign aims to deploy an urgent security patch, following the discovery of a critical security flaw in the Linux kernel, affecting all Linux servers since kernel 2.6.27 (which dates from 2008).

We are aware of the relatively high number of maintenance operations with impact in recent months: These operations are explained by the recent and close discovery of several critical flaws affecting the Linux kernel, as well as the KVM technology, used for the virtualization of VPS offerings by almost all hosting providers on the market.

A similar operation is planned for our other locations: We will observe a 24-hour delay between each location, in order to avoid the risk of multiple impacts for customers who have chosen to multiply locations for redundancy reasons.

During this campaign, each VPS located at our Paris POP will be restarted once, during the previously indicated time slot. Given the urgent nature of this maintenance and the short notification period, our team will endeavor to send an email notification, approximately 48 hours in advance, for each VPS, specifying the time slot when the VPS will be impacted.

The affected VPS will be shut down for a maximum estimated duration of 15 minutes during the planned time slot, then restarted.

In the vast majority of cases, no action is required on your part, but we nevertheless invite you to:

• Check that your applications installed on the VPS are correctly configured to operate after a restart;
• Check the status of your backups (we nevertheless insist that no data loss is expected, the VPS will simply be shut down, then restarted);
• As far as possible, properly suspend your activity before 21:00, during the time slot communicated by email, particularly if you host applications sensitive to restarts (databases, etc.).

Additional note related to CVE-2026-99999: This flaw in the Linux kernel impacts a very large number of OSes (Debian, Ubuntu, etc.) since 2008. We strongly invite you to check that your OS is up to date to ensure that it is itself protected against this flaw. This flaw is fixed starting from the following kernels: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11. More info at https://nvd.nist.gov/vuln/detail/cve-2026-99999

We thank you for your understanding.

All affected VPS instances are now operational again on their original host, which has been repaired. The move is complete and the incident is resolved.

We apologize for the interruption to your services and the inconvenience caused.

Affected customers will receive an email within the next few hours.

The affected virtual machines are now booting on their original host. They should be reachable again within the next few moments.

The incident remains open while we confirm that services are back online and complete our checks.

The affected virtual machines have been shut down. Their move from the temporary node back to their permanent host is in progress.

The affected VPS instances are temporarily unavailable during this operation. The incident will remain open until the virtual machines have restarted and we have verified that they are operating correctly.

We have received the replacement part. It will be installed this evening on the affected node in the MRS04 cluster.

The virtual machines currently hosted on the temporary node will then be moved back to their permanent host. This operation will require the affected VPS instances to restart, scheduled for 29 October between 20:30 and 21:00 (Paris time).

The incident will remain open until the intervention is complete and we have verified that services are operating correctly.

The affected VPS instances have restarted on the temporary node. An individual email will be sent to affected customers within the next few minutes.

The incident will remain open until the virtual machines have been moved back to their permanent host once it has been repaired.

Our teams are continuing their work to restore services. The affected VPS instances are expected to restart on the temporary node within the next few minutes.

The VPS instances will be restored to the state they were in before being shut down for maintenance. No data loss is expected.

Once services have been restored, an individual email will be sent to each affected customer.

The unavailable MRS04 node is now tracked separately from the scheduled maintenance, which is complete.

The incident remains ongoing. The intervention is expected to end on 22 October at 06:00 (Paris time).

The investigation has identified a hardware fault with the affected node's motherboard. A replacement procedure has been initiated with the manufacturer (RMA).

The affected VPS instances will be redeployed on a temporary node while the server is repaired and brought back into service.

Our teams have arrived on site in Marseille and are beginning their investigation into the affected node to identify why it failed to restart.

All nodes have been restarted, but we are nevertheless seeing an anomaly on one of the nodes in our VPS Performance range, which affects a handful of VPS located on the MRS04 cluster.

Normal restart operations, and those via BMC, failed on this node, which therefore requires human intervention in the datacenter. Our team will be on site around 23:30 and will carry out a diagnosis of the server concerned.

The scheduled maintenance operations on the Marseille VPS infrastructure are complete.

One node in the MRS04 cluster did not restart correctly. This issue affects a small number of Performance VPS instances and is tracked in a separate incident.

Maintenance has started as scheduled.

We inform you that a maintenance operation is scheduled on all clusters of our VPS ranges hosted at our Marseille POP, in order to apply an urgent security patch (CVE-2026-99999).

Date:

• Wednesday, October 21: From 21:00 to 23:00

This maintenance campaign aims to deploy an urgent security patch, following the discovery of a critical security vulnerability in the Linux kernel, affecting all Linux servers since kernel 2.6.27 (which dates from 2008).

We are aware of the relatively high number of impactful maintenance operations in recent months: These operations are explained by the recent and close discovery of several critical vulnerabilities affecting the Linux kernel, as well as the KVM technology, used for the virtualization of VPS offerings by almost all hosting providers on the market.

A similar operation is planned for our other locations: We will observe a 24-hour delay between each location, to avoid the risk of multiple impacts for customers who have chosen to multiply locations for redundancy reasons.

During this campaign, each VPS located at our Marseille POP will be restarted once, during the previously indicated time slot. Given the urgent nature of this maintenance and the short notification period, our team will endeavor to send an email notification, approximately 48 hours in advance, for each VPS, specifying the time slot when the VPS will be impacted.

The affected VPS will be shut down for a maximum estimated duration of 15 minutes during the scheduled time slot, then restarted.

In the vast majority of cases, no action is required on your part, but we nevertheless invite you to:

• Check that your applications installed on the VPS are correctly configured to operate after a restart;
• Check the status of your backups (we nevertheless insist that no data loss is expected, the VPS will simply be shut down, then restarted);
• As far as possible, gracefully suspend your activity before 21:00, during the time slot communicated by email, particularly if you host applications sensitive to restarts (databases, etc.).

Additional note related to CVE-2026-99999: This vulnerability in the Linux kernel affects a very large number of OSes (Debian, Ubuntu, etc.) since 2008. We strongly invite you to check that your OS is up to date to ensure that it is itself protected against this vulnerability. This vulnerability is fixed starting from the following kernels: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11. More info at https://nvd.nist.gov/vuln/detail/cve-2026-99999

We thank you for your understanding.

Maintenance is complete.

The maintenance is taking longer than expected, operations are continuing and should be completed around 15:00.

Following the recent announcement of a security vulnerability affecting PHP, we are performing preventive maintenance on the client area in order to deploy the security patches published by the PHP project.

During this operation, disruptions and temporary unavailability of the client area may occur.

We will keep you informed of the end of the maintenance. Thank you for your understanding.

PHP 8.2 to 8.5 version update

TuxCare has now updated its packages using the versions released by the PHP project, in addition to the backported fixes already deployed. The versions installed on our hosting platforms are:

• `alt-php82`: `8.2.35-1`
• `alt-php83`: `8.3.36-1`
• `alt-php84`: `8.4.27-1`
• `alt-php85`: `8.5.12-1`

The relevant security fixes were already present in the previous packages. This update brings the version numbers into line with those of the PHP project. It does not change the protection already provided against the vulnerabilities announced on 20 October.

Additional recommendation from the PHP project

In its 23 October advisory on session upload progress, the PHP project recommends disabling `session.upload_progress.enabled` until the next bugfix release.

This recommendation has already been applied across all our web hosting platforms, with `session.upload_progress.enabled = 0`. We are keeping this preventive measure in place while awaiting the announced fix.

No action is required on your part in Plesk or on your websites. The maintenance remains complete.

This morning, we received several questions about the PHP version number displayed in Plesk. Here is some clarification on the fixes that have been deployed.

The fixes for the vulnerabilities announced on 20 October have already been applied to all "Secured" PHP versions offered on our hosting platforms. No action in Plesk is required.

TuxCare ELS applies these fixes through backporting: the affected code is fixed without necessarily changing the PHP version number displayed. Fixes are tracked through the package revision and its security changelog. An older version number therefore does not mean that the fixes are missing.

For example, PHP 8.3.35 Secured includes the relevant fixes released in PHP 8.3.36. You do not need to change your site's PHP version in Plesk to benefit from them.

Command-line usage

The PHP interpreter called by default with the `php` command also includes these fixes. However, we recommend using the full path corresponding to your site's PHP version to maintain the same compatibility when running scripts, scheduled tasks or Composer commands.

For example, for a site running PHP 8.4: `/opt/plesk/php/8.4/bin/php`.

For more information:

• PHP updates and security with TuxCare ELS
• SSH access and PHP paths on Plesk hosting

The maintenance is complete. This update provides clarification on the fixes already deployed.

FRWEB14: fixed. Sites on this platform now run on PHP versions 7.4 to 8.5 patched against both vulnerabilities.

All our shared web platforms now use patched PHP versions. No action is required on your part

PHP 8.0 and 8.2: patched on FRWEB5 to FRWEB12 and CHWEB1. Our partner published these last two fixes shortly after midnight, and we installed them immediately, with no impact on the sites.

All PHP versions from 7.4 to 8.5 are now patched on FRWEB5 to FRWEB12 and CHWEB1.

FRWEB14: the patched versions of PHP 7.4 to 8.5 are installed, and we are currently finalizing their deployment on the sites on this platform.

No action is required on your part. Next update at the end of the work on FRWEB14.

PHP 8.5: fixed on FRWEB5 to FRWEB12 and CHWEB1. Our partner published the fix at 23:38, and we installed it immediately, with no impact on the sites.

Status of PHP versions on our shared web platforms:
- PHP 7.4, 8.1, 8.3, 8.4 and 8.5: fixed on all platforms except FRWEB14, which is waiting for the fixes to be published for its system.
- PHP 8.0 and 8.2: pending fixes from our partner. They will be installed automatically as soon as they are published. Until then, the application firewall blocks known attacks.

Next update when the final fixes are published.

Maintenance and deployment operations continue, as security patches are released by our patch provider.

In parallel, our teams maintain a very high level of vigilance on the subject, and we continue to deploy numerous WAF rules to limit any exposure, as the observed attack vectors evolve.

Maintenance is complete.

PHP 8.4: fixed on FRWEB5 to FRWEB12 and CHWEB1. Our partner published the fix at 22:10, and we installed it immediately, with no impact on the sites.

Where the PHP versions on our shared web platforms stand:
- PHP 7.4 and PHP 8.4: fixed on all platforms except FRWEB14, which is waiting for the fixes to be published for its system.
- PHP 8.0, 8.1, 8.2, 8.3 and 8.5: awaiting our partner's fixes. They will be installed automatically as soon as they are published. Until then, the application firewall blocks known attacks.

FRWEB4: the sites hosted on this platform run PHP 7.4, in a version fixed against these two vulnerabilities. As FRWEB4 is an older platform, our teams plan to migrate its sites to a fully maintained platform.

Next update when the other PHP 8.x fixes are published.

Web application firewall (WAF): at 19:17, our partner published new rules. They block other variants of the attack tool and detect malformed file uploads used to exploit these vulnerabilities. These rules are active on all our shared web platforms.

Status of PHP versions on our shared web platforms:
- PHP 7.4: fixed on all platforms except FRWEB14, which is awaiting the release of the fix for its system.
- PHP 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5: pending. Our partner announces the fixes around 22:00. They will be installed automatically as soon as they are published. Until then, the web application firewall blocks known attacks.

Next update upon the release of the PHP 8.x fixes.

The PHP Foundation released this afternoon the fixes for vulnerabilities CVE-2026-109618 and CVE-2026-109619 for PHP 8.2, 8.3, 8.4 and 8.5. Versions 7.4, 8.0 and 8.1 are fixed by our partner maintenance program.

Protection status of our shared web platforms (FRWEB5 to FRWEB12, FRWEB14, CHWEB1):

• Web application firewall (WAF): blocking rules for known attacks have been active on all these platforms since last night.
• Maintained PHP versions: all sites have been switched to PHP versions maintained and continuously patched by our partner, from PHP 7.4 to PHP 8.5, without changing the version for your sites.
• PHP 7.4: fixed on FRWEB5, FRWEB6, FRWEB7, FRWEB8, FRWEB9, FRWEB10, FRWEB11, FRWEB12 and CHWEB1. FRWEB14 will be fixed as soon as the patch for its system is released.
• Webmails: fixed on all platforms.
• PHP 8.0 to 8.5: the fixes are expected this evening. They will be deployed automatically as soon as they are released.
• Plesk administration panel: the vendor has announced a fix for today. It will be applied as soon as it is available.

These deployments are performed transparently. Short interruptions of a few seconds to a few minutes may have occurred on some sites.

The PHP Foundation announced last night the discovery of two critical security vulnerabilities in the PHP project, affecting all PHP versions since PHP 5.0: CVE-2026-109618 and CVE-2026-109619. These security vulnerabilities are directly related to PHP and potentially allow taking control of any website running PHP, regardless of its configuration.

The exact details of these vulnerabilities have not yet been published: The PHP Foundation announced the publication of details for today at 4 PM (Paris time) along with the first security patches.

Nevertheless, some elements are already anticipated regarding these vulnerabilities: They would affect all PHP versions since PHP 5.0 (since 2004), and the PHP Foundation would only provide patches for sites running PHP 8.1, 8.2, 8.3, 8.4 and 8.5.

Our team has conducted a full audit of our shared WEB infrastructures (Plesk), primarily affected by these vulnerabilities, due to the very high number of websites using PHP on these platforms. We also deployed during the night a first batch of security patches (including dynamic WAF firewalling rules), aimed at reducing our clients' exposure to these vulnerabilities.

We will also deploy the security patches for PHP versions 8.1, 8.2, 8.3, 8.4 and 8.5 as soon as they are published by the PHP version.

Finally, we also plan security patches for PHP versions 7.4, 8.0 and 8.1: These versions are EOL, but are still offered on our infrastructures, and receive regular security patches via a partner maintenance program. We estimate that these patches will be available very quickly after the publication of patches for more recent PHP versions.

The incident is resolved. The PulseHeberg management panel is fully operational again. We apologize for the inconvenience caused.

We are currently experiencing an incident on the PulseHeberg management panel, causing difficulties in managing VPS Cloud services. Our teams are working to resolve it.

This incident only affects the management panel, the VMs remain operational.

Maintenance is complete.

Maintenance has started as scheduled.

We inform you that a maintenance operation campaign is planned on all clusters of our VPS ranges hosted at our Paris POP. This operation will take place on October 3 and 4, during the following time slots:

Dates:

- Saturday, October 3: From 21:00 to 23:00
- Sunday, October 4: From 21:00 to 23:00
This campaign is part of our routine maintenance operations, with the goal of maintaining our infrastructures in operational condition, in particular to deploy urgent security patches recommended by our vendor.

During this campaign, each VPS located at our Paris POP will be restarted once, during one of the previously mentioned time slots. Our team will endeavor to send an email notification, approximately 24 hours in advance, for each affected VPS, indicating the time slot to which the VPS will be assigned.

The affected VPS will be shut down for a maximum estimated duration of 15 minutes during the scheduled time window, then restarted.

In the vast majority of cases, no action is required on your part, but we nevertheless invite you to:

- Check that your applications installed on the VPS are correctly configured to operate after a restart;
- Check the status of your backups (we nevertheless emphasize that no data loss is expected, the VPS will simply be shut down, then restarted);
- As far as possible, cleanly suspend your activity before 21:00, during the time slot communicated by email, especially if you host applications sensitive to restarts (databases, etc.).
We thank you for your understanding.

Maintenance is complete.

Maintenance has started as scheduled.

We inform you that a maintenance operation campaign is scheduled on all clusters of our VPS ranges hosted at our Paris POP. This operation will take place on October 3 and 4, during the following time slots:

Dates:

• Saturday, October 3: From 21:00 to 23:00
• Sunday, October 4: From 21:00 to 23:00

This campaign is part of our routine maintenance operations, with the goal of maintaining our infrastructure in operational condition, in particular to deploy urgent security patches recommended by our vendor.

During this campaign, each VPS located at our Paris POP will be restarted once, during one of the time slots mentioned above. Our team will endeavor to send an email notification, approximately 24 hours in advance, for each affected VPS, indicating the time slot to which the VPS will be assigned.

The affected VPS will be shut down for a maximum estimated duration of 15 minutes during the scheduled time window, then restarted.

In the vast majority of cases, no action is required on your part, but we nevertheless invite you to:

• Check that your applications installed on the VPS are correctly configured to operate after a restart;
• Check the status of your backups (we nevertheless emphasize that no data loss is expected, the VPS will simply be shut down, then restarted);
• As far as possible, gracefully suspend your activity before 21:00, during the time slot communicated by email, in particular if you host applications sensitive to restarts (databases, etc.).

We thank you for your understanding.