UPDATES (13:50 EDT)

Mitgation May Block Forms:

We have blocked multi-part uploads on many servers. This will cause forms to break and you may not be able to post.   This will remain in effect until we have other mitigation tools or the vendors release patches. 

Vendor Patches

We have automated systems for Plesk and cPanel checking for the lastest patches and pushing them out on a schedule basis. 

See the links below for notes on vendor patches.  Most servers we manage have already been patched if the version you are using is supported by the panel.

Plesk: 

https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk

Cpanel

https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/

Mitigations:

We are applying some mitigations to systems without control panels first.  This could cause some forms to stop functioning.   We are applying these to all systems as a precuation and then will roll back the restrictions as we evaluate each case.

Cloudflare Protected Sites

If your site uses Cloudflare, they are using some experiemental rules to mitigate possible exploit vectors.

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Reboots

We may need to reboot servers with little advanced noticed depending upon the mitigations.   If your server is offline for more than 5 minutes, please open a non urgent/critical ticket and we will investigate.

References

https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/

https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities

You may have seen news reports about two critical vulnerabilities in PHP, the language that powers many websites. We want to let you know where things stand.

We are actively monitoring the situation and have already inventoried every server and website we manage, so we know exactly which systems are affected and which PHP version each site uses.

The PHP project released fixed versions today:
https://www.php.net/archive/2026.php#2026-10-21-5

This release does not mean a patch is available for your server yet.

Most of our servers get PHP through their operating system or control panel (such as cPanel or Plesk), and those vendors need to package and release their own updates first.

As soon as official patches or mitigations are available for your platform, we will apply them promptly.

You don't need to take any action right now. We will update this ticket as things progress.

If you have questions, open a support ticket.

We’ve updated the backup retention policy for managed AWS Lightsail instances. Automatic snapshots now follow a Grandfather-Father-Son scheme:

• Daily: 1 snapshot per day, kept for 7 days
• Weekly: 1 snapshot per week, kept for 4 weeks
• Monthly: 1 snapshot per month, kept for 2 months

Older snapshots are deleted automatically. The oldest available restore point is about 2 months old.

Yearly snapshots discontinued: To manage costs, we’ve removed the yearly snapshot. It was rarely, if ever, used and added significant storage costs.

Region: All backups are stored in the same AWS region as your instance. If you need cross-region backups, please contact us for an estimate.

If you need longer retention or a snapshot before a planned change, please open a ticket.

Effective: Oct 1 2026

Updated: Oct 10 2026

We’ve updated the notification settings on Plesk-powered servers to be more detailed. This gives you better visibility into the automated tasks Plesk now performs and helps us catch potential issues sooner.

What this means for you: You’ll now receive all administrative notices from Plesk, so you may see new or more frequent messages. This is expected and caused by this change.

What rackAID monitors: We also receive update, SSL, overuse, and security notices. We do not monitor routine account changes such as modifications or suspensions. Those notices are for your information only.

If these notifications cause problems or you’d like them adjusted, please open a ticket and let us know.

Snapshot Retention — Managed AWS Instances

Where backup services are included in your Order, we retain system snapshots for managed AWS instances on a Grandfather-Father-Son (GFS) schedule:

• Daily: 1 snapshot per day, retained for 10 days
• Weekly: 1 snapshot per week, retained for 4 weeks
• Monthly: 1 snapshot per month, retained for 2 months
• Yearly: 1 snapshot retained annually

Snapshot rotation and pruning run weekly rather than daily, so daily snapshots may persist somewhat longer than the nominal 10-day window before they are trimmed. This is expected behavior and does not reduce the guaranteed minimum retention at each tier.

Regardless of any backup service purchased from us, you remain responsible for maintaining your own backups per the Master Service Agreement (MSA §13.2(v)) and for exporting or retrieving your data before termination (MSA §12.1.1).

Security Notice: CVE-2026-31431 ("Copy Fail")

A high-severity Linux kernel privilege escalation vulnerability known as Copy Fail (CVE-2026-31431) was publicly disclosed on April 29, 2026.

The flaw affects the kernel's `algif_aead` crypto interface and allows a local user to gain root access.

CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on May 1, 2026 after observing active exploitation.

All servers under our management have been either patched with the fixed kernel or have appropriate mitigations applied. 

Servers were rebooted as part of this process.

We've verified each system across our fleet and confirmed protection against the published exploit.

No customer action is required.

References:
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA advisory: https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog
- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-31431

If you have any questions, please open a support ticket.