Affecting Other - WHMCS (Client area) features

• 21/10/2026 09:44 - 28/10/2026 11:18
• Last Updated 23/10/2026 16:00

23/10/2026

The current recommendation from the PHP foundation is that the PHP setting session.upload_progress.enabled should be set to Off.  This setting was changed accordingly across our shared hosting services (on Wednesday), and on all customer VPS servers (today, 23/10/206).

Update @ 15:00 GMT: The PHP updates have been released by PHP themselves and are becoming available for control panels through our partners now. We are working on patching PHP versions across our estate of shared hosting servers.  These patches will be for all versions of PHP from 7.4 and above.   No patch has been released for PHP5.6 (which went EOL at the end of 2018) and there is no certainty that there will be one.  We highly recommend that any customers using PHP5.6 should urgently update or, where that is not possible, migrate to newer applications which are supported by modern versions of PHP. 

Update @ 22:00 GMT: Updates to Plesk PHP versions were released and patched at around 5pm, and the CloudLinux EA4 updated PHP versions have just become available and so we are currently in the process of patching our cPanel/WHM estate.  The EA4 PHP versions being provided by CloudLinux include patched versions of older versions of PHP (Notably PHP 5.6) - although we would still recommend moving from PHP5.6 to PHP8.4+ this patch makes that less critical.

Update @ 23:00 GMT: Plesk administrative access on port 8443 is currently blocked as we arae awaiting a plesk update which will secure the plesk administrative interface's own PHP interpreter which is currently still vulnerable.

The PHP project has announced two critical security vulnerabilities in PHP itself. PHP is used by most websites, including WordPress, Joomla and many other applications, so this affects hosting providers worldwide. Technical details have not yet been published, and there is currently no complete workaround. The only full fix is an updated version of PHP. PHP has scheduled fixed releases for 14:00 UTC today (21 October 2026).

What we have done

• Applied the currently known mitigations across our shared hosting servers and the servers we manage for customers. These reduce risk but do not fully protect against the vulnerabilities, which is why patching remains essential.
• Put additional monitoring in place to help us identify suspicious activity.
• Started working with our upstream partners (the control panel and PHP vendors) so that patched versions can be tested and applied across all servers as soon as they are available to us.
• Applied some restrictions to our own websites based on the reported vulnerabilities; at present file uploads in support tickets are disabled, and some customers may encounter issues placing support tickets - in that case please send an email from the email address on your account with us to our support email address.

Timeline

• Once the PHP project releases its fixes (at 14:00 UTC), our vendors need to package them for our platforms. We do not control that timing, but we will roll out patches as soon as they are available.
• Patches will be applied server-wide. You do not need to do anything to receive them, and we will update this page when they are applied.
• Some older PHP versions (8.1 and below) are not expected to receive an official fix. We are working with our partners on options for these, and will share more when we know.
• We expect no downtime from patching. PHP processes may restart briefly.

Recommendations

• Use a supported PHP version (8.2 or newer) for your sites if you can. You can change this in your control panel.
• Keep your website software, plugins and themes up to date, and remove any you no longer use.
• If you would prefer to take your site offline until patches are applied, you can do this yourself, for example with a maintenance mode plugin. We are not able to take individual sites offline and bring them back on request, and you do not need to wait for us to contact you before restoring your site.
• If you notice anything unusual, such as unfamiliar files, new admin users or unexpected redirects, please contact support.

We will keep this page updated throughout the process.

Affecting Other - Wordpress

• 23/07/2026 13:00 - 24/08/2026 14:02
• Last Updated 26/07/2026 17:52

Two critical WordPress core vulnerabilities have recently been disclosed. The first (CVE-2026-60137) is a SQL injection flaw in WordPress's query handling; the second (CVE-2026-63030) chains with it to allow unauthenticated remote code execution via the REST API. As an example of what this vulnerability allows, an attacker can create a new wordpress admin user into a website, thereby gaining full access at an administrative  level to the website.  Both are actively exploited in the wild and are listed on the CISA Known Exploited Vulnerabilities catalogue.  The combination of these CVEs and the resulting family of exploits are being referred to as 'wp2shell'.

We have deployed a network-level mitigation across shared hosting fleet on Thuirsday 23/07/2026 which blocks the affected REST API endpoint at the web server layer, protecting sites regardless of their WordPress version. The fix is available in WordPress 7.0.2 (and 6.8.6 / 6.9.5 for older branches - the vulnerability was introduced in 6.0). We recommend updating WordPress core at your earliest convenience.

In some cases the mitigation may affect certain WordPress admin features, most commonly the Appearance -> Widgets editor. If you experience issues with your WordPress dashboard, please open a support ticket and we can apply an exemption to updated Wordpress websites.

Affecting System - JetBackup

• 14/03/2025 17:12 - 20/03/2025 11:17
• Last Updated 14/03/2025 17:14

Our JetBackup backup service is currently undergoing maintenance while our engineers expand the capacity and improve performance of our backup systems.

This will mean that JetBackup backups will not be available for recovery during this maintenance period.  We expect JetBackup in Plesk and cPanel control panels to be available again on Monday.

Please note that backups are still being taken - should you need to restore files, databases or email, please raise a support ticket and our engineers will complete that process for you.

• 25/07/2024 14:08 - 08/08/2024 09:20
• Last Updated 25/07/2024 14:12

Dear 1st Domains customers,

Due to a significant hardware failure around 9am this morning, our hosted exchange service is currently unavailable. Work is underway to recover the service, which we expect to be restored later this afternoon.  There should be no significant loss of data, excepting the period where the server was unavailable.

Our sincere apologies for the disruption.

Kind regards,

1st Domains Hosting

• 19/08/2021 16:25
• Last Updated 20/08/2021 10:03

We are aware of an issue affecting customers using our Exchange Email service. This is currently being looked into by our engineers and we hope to have a resolution as soon as possible. We apologies for the inconvenience caused during this time and appreciate your patience whilst we work towards a fix. 

Update 20/08/2021 - 09:50 - Our engineers appear to have identified the possible cause and hope to have this resolved shortly. 

Update 20/08/2021 - 10:02 - We are asking customers to test their email service as we believe full functionality has now resumed. 

• 22/06/2020 08:50 - 30/03/2021 22:10
• Last Updated 22/06/2020 13:00

We are aware of ongoing issues affecting a number of our Mail Exchange customers following the previously corresponded data migration. This is due to an unexpected delay in the finishing time for the migration. We hope to have the service restored shortly and apologise for any inconvenience caused during this time. 

Update: 12:50 - We ask any customers affected by the before mentioned issues to test their email capabilities as service should now be resumed.