We recently moved to a new billing system. During the migration, some customers received duplicate invoice notices.

You have not been charged twice.

The duplicates were notification errors only, and no duplicate charges were made to any account.

If you received a duplicate notice for an invoice you’ve already paid and would like us to confirm your account status, please a support ticket and our team will review it.

We apologize for the confusion and appreciate your patience.

UPDATES (21:30 10/22)

Curent Status

We have fully patched or mitigated all servers under our control - unless you have been notified otherwise. 

In some cases, we had to swtich  PHP to an alternate provider, especially if you were on PHP 5.x or 7.3 or below.   We will be contacting impacted customers in the next few days.

We continue to monitor the situation as it is fluid and more updates and reboots may be needed in coming days.

Mitgation May Block Forms:

We have blocked multi-part uploads on many servers. This will cause forms to break and you may not be able to post.   This will remain in effect until we have other mitigation tools or the vendors release patches.    

Upon submitting the form you may get a 403 error.   This mainly applies to servers running older versions of PHP (PHP 5.x , PHP 7.x)

Vendor Patches

We have automated systems for Plesk and cPanel checking for the lastest patches and pushing them out on a schedule basis. 

AWS is to supply patches for their Linux system on 10/22/2026.   AlmaLinux systems are being patched in the next 24 hours.

See the links below for notes on vendor patches.  Most servers we manage have already been patched if the version you are using is supported by the panel.

Plesk: 

https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk

Cpanel

https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/

Mitigations:

We are applying some mitigations to systems without control panels first.  This could cause some forms to stop functioning.   We are applying these to all systems as a precuation and then will roll back the restrictions as we evaluate each case.

Cloudflare Protected Sites

If your site uses Cloudflare, they are using some experiemental rules to mitigate possible exploit vectors.

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Reboots

We may need to reboot servers with little advanced noticed depending upon the mitigations.   If your server is offline for more than 5 minutes, please open a non urgent/critical ticket and we will investigate.

References

https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/

https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities

You may have seen news reports about two critical vulnerabilities in PHP, the language that powers many websites. We want to let you know where things stand.

We are actively monitoring the situation and have already inventoried every server and website we manage, so we know exactly which systems are affected and which PHP version each site uses.

The PHP project released fixed versions today:
https://www.php.net/archive/2026.php#2026-10-21-5

This release does not mean a patch is available for your server yet.

Most of our servers get PHP through their operating system or control panel (such as cPanel or Plesk), and those vendors need to package and release their own updates first.

As soon as official patches or mitigations are available for your platform, we will apply them promptly.

You don't need to take any action right now. We will update this ticket as things progress.

If you have questions, open a support ticket.

We’ve updated the backup retention policy for managed AWS Lightsail instances. Automatic snapshots now follow a Grandfather-Father-Son scheme:

• Daily: 1 snapshot per day, kept for 7 days
• Weekly: 1 snapshot per week, kept for 4 weeks
• Monthly: 1 snapshot per month, kept for 2 months

Older snapshots are deleted automatically. The oldest available restore point is about 2 months old.

Yearly snapshots discontinued: To manage costs, we’ve removed the yearly snapshot. It was rarely, if ever, used and added significant storage costs.

Region: All backups are stored in the same AWS region as your instance. If you need cross-region backups, please contact us for an estimate.

If you need longer retention or a snapshot before a planned change, please open a ticket.

Effective: Oct 1 2026

Updated: Oct 10 2026

We’ve updated the notification settings on Plesk-powered servers to be more detailed. This gives you better visibility into the automated tasks Plesk now performs and helps us catch potential issues sooner.

What this means for you: You’ll now receive all administrative notices from Plesk, so you may see new or more frequent messages. This is expected and caused by this change.

What rackAID monitors: We also receive update, SSL, overuse, and security notices. We do not monitor routine account changes such as modifications or suspensions. Those notices are for your information only.

If these notifications cause problems or you’d like them adjusted, please open a ticket and let us know.