Active Notices

Plesk2 (plesk2.webclick.com.au) Critical PHP Security Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Two critical security vulnerabilities affecting PHP itself have been identified. Details of the vulnerabilities leaked publicly on Tuesday, October 20, 2026, ahead of their planned disclosure, and the PHP security team has scheduled an emergency security release for Wednesday, October 21, 2026 at 14:00 UTC (approximately 10:00 PM AWST, Wednesday, October 21).

Please note: Customers on our Shared Hosting platform or on a VPS with a maintenance plan do not need to take any action. WebClick will apply the patch on your behalf.

  • Update:

    Most shared hosting web servers have been patched with the latest versions of PHP. Our technicians worked through the night to ensure nodes were patched and are now addressing older systems and running tests.

  • Update:

    Technicians continue to assist customers with virtual servers to update their software. We are monitoring the shared hosting servers and tweaking mitigation techniques based on the latest information available.

  • Update:

    We are continuing to work with our customers to ensure their virtual servers are updated and websites are migrated to the patched versions of PHP.

    • Some systems are experiencing issues

    Past Incidents

    Plesk2 (plesk2.webclick.com.au) Critical PHP Security Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

    Two critical security vulnerabilities affecting PHP itself have been identified. Details of the vulnerabilities leaked publicly on Tuesday, October 20, 2026, ahead of their planned disclosure, and the PHP security team has scheduled an emergency security release for Wednesday, October 21, 2026 at 14:00 UTC (approximately 10:00 PM AWST, Wednesday, October 21).

    Please note: Customers on our Shared Hosting platform or on a VPS with a maintenance plan do not need to take any action. WebClick will apply the patch on your behalf.

  • Update:

    Most shared hosting web servers have been patched with the latest versions of PHP. Our technicians worked through the night to ensure nodes were patched and are now addressing older systems and running tests.

  • Update:

    Technicians continue to assist customers with virtual servers to update their software. We are monitoring the shared hosting servers and tweaking mitigation techniques based on the latest information available.

  • Update:

    We are continuing to work with our customers to ensure their virtual servers are updated and websites are migrated to the patched versions of PHP.

    • Tuesday 1st September 2026

    Colocation Network Network DDOS/flood detected

    Technicians have identified a network DDOS/flood from 3:47pm to 3:55pm traversing one of our primary network links.

    Other redundant links remained online during this event, however the attack traffic resulted in increased latency during the event.

    Technicians are investigating the root cause, if the malicious traffic returns then DDOS scrubbing / filtering will be engaged.

  • Update:

    Technicians are continuing to work with our network carriers to deploy additional future mitigation strategies.