Is Libyan Spider Down?

This incident has been resolved. All telemetry is within nominal levels. --- [2026-10-29T09:24:05.166+01:00] (monitoring) A fix has been implemented, and we observe large improvement in latency and reduced packet loss. We continue to monitor the situation. --- [2026-10-29T08:12:06.388+01:00] (investigating) We are currently experiencing a connectivity issue in Tripoli, resulting in increased latency, packet drops, and congestion. Our team is working to restore the service as soon as possible.

Security Advisory – Node.js Vulnerabilities (October 2026) Following the Node.js security releases published on October 21, 2026, addressing 10 security vulnerabilities, including CVE-2026-111497, Libyan Spider has proactively applied the available security updates across its shared hosting infrastructure. These vulnerabilities include a high-severity issue that could potentially allow remote code execution under certain conditions. Libyan Spider Shared Hosting – Security Updates Applied Our infrastructure team has successfully deployed the available Node.js security updates across **all Libyan Spider shared hosting servers running CloudLinux 7**/8**. Customers using these shared hosting services do not need to manually install the Node.js security packages, as the required server-level updates have already been applied. Important: Node.js applications may require a restart to load the updated runtime. Unmanaged VPS, Cloud Servers, and Dedicated Servers – Action Required Customers operating unmanaged VPS, cloud instances, or dedicated servers are responsible for maintaining and securing their operating systems and application environments. If your server runs Node.js, we strongly recommend taking the following actions: 1. Review the installed Node.js versions and identify affected applications. 2. Apply the latest available security updates from your operating system repositories or Node.js distribution provider. 3. Upgrade to patched Node.js releases, where applicable: - Node.js 22.23.4 - Node.js 24.22.1 - Node.js 26.12.1 4. Restart affected Node.js applications and services to ensure the security updates take effect. 5. Verify the running Node.js versions after completing the updates. Customers using CloudLinux Node.js Selector should install the corresponding patched `alt-nodejs` packages provided by CloudLinux. Please note: Server-level updates on Libyan Spider shared hosting do not automatically update independently managed Node.js installations on unmanaged services. Our Commitment to Security Libyan Spider continues to monitor relevant security advisories and apply available patches to its managed infrastructure to maintain a secure and reliable hosting environment. We strongly encourage customers who manage their own servers to review their environments and apply necessary security updates promptly. References: - [CloudLinux Security Advisory](https://cloudlinux.statuspage.io/incidents/s5rdn3jtxzjn) - [Node.js Official Security Releases](https://nodejs.org/en/blog/vulnerability/)

Security Update – Patched PHP Templates Available on JPaaS We have made updated PHP container templates available on our JPaaS platform to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. The following patched PHP versions are now available: - PHP 8.5.12 - PHP 8.4.27 - PHP 8.3.36 - PHP 8.2.35 Action Required: Customers running PHP-based applications on JPaaS (Apache, Nginx, LiteSpeed, etc) must redeploy their containers using one of the updated PHP image tags listed above to apply the security fixes. Important: Existing running containers are not automatically updated when new templates become available. Customers must explicitly perform a "Redeploy" operation using a patched image tag to ensure their applications are protected. We strongly recommend completing this action immediately to minimize exposure to these vulnerabilities. --- [2026-10-22T11:30:35.772+02:00] (monitoring) Security Update – PHP Vulnerabilities CVE-2026-109618 / CVE-2026-109619 We have deployed the available security patches addressing CVE-2026-109618 and CVE-2026-109619 across our managed hosting infrastructure. The current patching status for each hosting service is as follows: Shared Linux Hosting - All PHP versions have been updated or patched to their respective fixed versions. Shared Windows Hosting - PHP versions 8.2, 8.3, 8.4, and 8.5 have been updated to the fixed versions. - PHP versions earlier than 8.2 will not receive updates. - Customers using older PHP versions must verify their websites' PHP configurations and switch to a supported, patched PHP version immediately. Managed Dedicated Servers & VPS - PHP versions 7.4 through 8.5 have been updated or patched to their respective fixed versions. - PHP versions earlier than 7.4 will not receive updates (except for CloudLinux servers). - Customers using older PHP versions must verify their websites' PHP configurations and switch to a supported, patched PHP version immediately. Unmanaged Dedicated Servers & VPS - Customers are responsible for maintaining and updating their server environments. - We strongly urge all customers to check their installed PHP versions and apply the available security updates immediately. Important: Customers running outdated or unsupported PHP versions should upgrade to a supported, patched version without delay to protect their websites and applications against potential exploitation. We will continue monitoring the situation and taking appropriate measures to maintain the security of our hosting infrastructure. --- [2026-10-21T16:46:07.969+02:00] (identified) PHP updates are out Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. - PHP security advisory - https://www.php.net/archive/2026.php#2026-10-21-5 - PHP downloads - https://www.php.net/downloads.php - Advisories: CVE-2026-109618 https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w and CVE-2026-109619https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) cPanel is releasing updates with partial backporting. The updated packages are 8.5.12, 8.4.27, 8.3.36, 8.2.35, along with the backported versions 8.1.34,8.0.30, and 7.4.33 CloudLinux packages are not released yet. If you rely on the volunteer-maintained rpms.remirepo.net, PHP says it will not have updates today and urges switching to distribution packages or building from source. --- [2026-10-21T15:36:35.768+02:00] (identified) We have proactively deployed a ModSecurity blocking rule to mitigate the publicly circulating exploit pattern associated with CVE-2026-109618 and CVE-2026-109619, targeting PHP's session upload progress handling in multipart HTTP requests. This mitigation has been rolled out across our Shared Hosting, Managed Dedicated Servers, and Managed VPS environments as an additional layer of protection. Important: This mitigation is a temporary protective measure and does not constitute a complete fix for the underlying vulnerabilities. It does not replace the need to upgrade PHP to the patched versions as soon as they become available. We are closely monitoring the situation and will continue taking the necessary steps to protect our hosting infrastructure and customers. --- [2026-10-21T11:45:14.033+02:00] (investigating) The PHP Security Team has announced an upcoming security release scheduled for Wednesday, 21 October 2026 at 16:00 UTC+2. It addresses two critical vulnerabilities, publicly reported as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical). Technical details and affected versions are scheduled to be disclosed at that time. We will post updates here as more information becomes available. Official announcement: https://www.php.net/archive/2026.php#2026-10-20-1