Is InMotion Hosting down?

We are applying urgent security mitigations across our server infrastructure to address recently disclosed PHP security vulnerabilities (CVE-2026-109618 / CVE-2026-109619). As part of this update, we are disabling the default PHP session.upload_progress.enabled setting. While standard platforms (including WordPress) remain unaffected, custom non-WordPress sites relying on PHP native file upload progress tracking may experience functionality changes.

Our Systems Engineering and Security teams are actively deploying critical cPanel security updates to address the recently disclosed php2shell vulnerability across supported PHP versions. Current Deployment Status by Environment: **Dedicated Servers:** Resolved. Updates have been successfully applied across all dedicated server infrastructure. **VPS Containers:** In Progress. Security patches are currently being deployed across all virtual private servers. **Shared Hosting:** Monitoring & Preparing. We are awaiting the upstream security patch from CloudLinux for older PHP versions. Our engineering team is fully prepared to roll out cPanel updates across all shared hosting clusters immediately upon CloudLinux's release. You can follow upstream progress directly via the [CloudLinux Incident Status Page](https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5).

Our Systems Engineering and Security teams are continuing to deploy critical cPanel security updates to address the recently disclosed php2shell vulnerability across supported PHP versions. Current Deployment Status by Environment: Dedicated Servers: In Progress. Updates have been successfully applied across all dedicated server infrastructure. VPS Containers: In Progress. Security patches are currently being deployed across all virtual private servers. Shared Hosting: Monitoring & Preparing. We are awaiting the upstream security patch from CloudLinux for older PHP versions. Our engineering team is fully prepared to roll out cPanel updates across all shared hosting clusters immediately upon CloudLinux's release. More information is available at https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/ You can follow upstream progress directly via the CloudLinux Incident Status Page.

As we continue to await official patches from CWP to mitigate the identified vulnerability we have determined the safest course of action at this time is to also restrict ports for CWP/CWP Admin as the panel itself utilizes PHP to function. Access to CWP and CWP Admin is possible if your IP address has been allowed in the firewall; Support can assist with this to restore your access. Webmail ports will remain open during this unplanned maintenance. There is no current estimate on when official patches will be provided, but as soon as those are distributed and applied and we can confirm and ensure the success of the updated patches we will revert the restrictions on the CWP/CWP Admin ports and function should return to normal.

As we continue to await official patches from CWP to mitigate the identified vulnerability we have determined the safest course of action at this time is to restrict ports for CWP/CWP Admin as the panel itself utilizes PHP to function. Access to CWP and CWP Admin is possible if your IP address has been allowed in the firewall; Support can assist with this to restore your access. Webmail ports will remain open during this unplanned maintenance. There is no current estimate on when official patches will be provided, but as soon as those are distributed and applied and we can confirm and ensure the success of the updated patches we will revert the restrictions on the CWP/CWP Admin ports and function should return to normal.

PHP version upgrades are being committed and have already been performed across Shared and Dedicated servers. PHP version upgrades for the VPS fleets are currently being performed. There is still no estimate to when this will be complete, but as soon as everything is patched and deemed functioning safely we will lift any restrictions and update accordingly.

The PHP version upgrades for the VPS fleets are still in progress. An accurate estimate of when function will be fully restored is not possible at this time, but services should be returning as the patching completes.

The PHP version upgrades for the VPS fleets are still in progress. Services should be returning as the patching completes. An accurate estimate of when function will be fully restored is not available at this time.

**Dedicated Servers:** Complete. Patched PHP packages addressing CVE-2026-109618 and CVE-2026-109619 have been applied across all dedicated server infrastructure. **VPS: **In Progress. Security patches are still being deployed across the VPS fleet. **Shared Hosting:** Complete. CloudLinux has released patched PHP packages for all supported versions, and these are being applied across our shared hosting servers. Source: https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5 Shared hosting customers may notice that the PHP version number shown on their account has not changed after patching. CloudLinux applied the security fix directly to the existing PHP builds rather than releasing new version numbers. For example, a patched PHP 8.3 will continue to report version 8.3.35 rather than 8.3.36. Third-party security scanners that check only version numbers may incorrectly flag these accounts as vulnerable. The session.upload_progress.enabled setting disabled on Oct 20 remains in place as additional hardening.

CWP has released version [1.21](https://control-webpanel.com/changelog), and our teams are actively pushing these updates. Dedicated servers are now receiving CWP updates by our Engineering teams, with VPS plans to follow suit shortly after. Thank you for your extended patience as your security is paramount to us.

At this time the following dedicated servers are undergoing unplanned maintenance. ded6403, ded6371, ded6337, ded6386, ded6399,ded6338, ded6401, ded6364, ded6385, ded6347, ded6349, ded6372, ded7304, ded6345, ded6380, ded6341, ded6387, ded6377, ded6404, ded6400, ded6370, ded6383, ded6378 At this time we do not have an ETA of when they will be back online. We apologize for any inconvience this may cause.

We're currently experiencing unplanned maintenance on our domain management platform. During this maintenance period, domain management features and self-service tools will be temporarily unavailable, and our support team will be unable to process domain-related requests on your behalf. Updates will be provided as they become available. We apologize for any inconvenience and appreciate your patience!

At this time, maintenance has concluded and we are monitoring the connections for stability.

This has been resolved. We appreciate your patience.

We are currently undergoing scheduled system maintenance on our domain management platform to improve security, stability, and system performance. During this maintenance window, domain management features and self-service tools will be temporarily unavailable, and our support team will be unable to process domain-related requests on your behalf. We apologize for any inconvenience and appreciate your patience while we work to upgrade our systems. Updates will be posted here as maintenance progresses.

At this time, maintenance has concluded and we are monitoring the connections for stability.

This has been resolved. We appreciate your patience.

We are currently undergoing scheduled system maintenance on our domain management platform to improve security, stability, and system performance. During this maintenance window, domain management features and self-service tools will be temporarily unavailable, and our support team will be unable to process domain-related requests on your behalf. We apologize for any inconvenience and appreciate your patience while we work to upgrade our systems. Updates will be posted here as maintenance progresses.

The maintenance is now complete. If you experience any difficulties, please reach out to our Support team. We appreciate your patience!