Is Krystal down?

Status: Investigating We’re aware of an issue affecting this server and are actively investigating the issue. Some services may be unavailable or delayed while we work on a fix. We’ll share another update as soon as we have more information or service is restored. Affected components Shared Hosting (Degraded performance)

Status: Resolved Service has been restored on this server, and all affected systems are back online. We’re continuing to monitor for any remaining issues. Thank you for your patience while we worked through this. Affected components Shared Hosting (Operational)

Status: Investigating We’re aware of an issue affecting C102 and are actively investigating. Some services may be unavailable or delayed while we work on a fix. We’ll share another update as soon as we have more information or service is restored. Affected components Shared Hosting (Degraded performance)

Status: Resolved Service has been restored on this server, and all affected systems are back online. We’re continuing to monitor our end and investigate any remaining issues. We appreciate your patience while we worked through this. Affected components Shared Hosting (Operational)

Status: Monitoring We are currently experiencing higher than usual support volumes due to the critical PHP (CVE-2026-109618 / CVE-2026-109619) and NodeJS vulnerabilities (CVE-2026-105483, CVE-2026-106069, CVE-2026-111497). Please see our other status updates for further details on those. We appreciate your patience and hope to get back to our usual prompt response times as soon as possible.

Status: Resolved We're continuing to monitor volumes, following the critical vulnerabilities, though normal response times should currently be expected. Thank you for your patience.

Status: Investigating We're aware of several security vulnerabilities announced today by Node.js, affecting the 22.x, 24.x and 26.x release lines. We're reviewing the impact on our services and will apply the patched versions across our servers as soon as our vendors release them. We'll update this notice as more information becomes available.

Status: Investigating Several mitigation options have been identified whilst we await patched versions from our upstream partners. These are presently being rolled out by our team. We do not detect any signs of exploitation at the time of writing. We will continue to monitor and ensure that your accounts remain secure. Your patience and cooperation are greatly appreciated.

Status: Investigating A mitigation is currently being implemented for the Brotli RCE (CVE-2026-111497). Other mitigation options are being investigated for the other CVEs, and we are awaiting publication of patched packages by upstream.

Status: Investigating The Brotli RCE (CVE-2026-111497) has been mitigated fleet-wide, and on all customer servers that are managed by our team. We will continue to work on the remaining CVEs, applying mitigations where available and awaiting fixed versions from upstream. Thank you for your patience and cooperation.

Status: Investigating Our mitigation against the Brotli-related Node.js vulnerability remains deployed across our hosting fleet and all customer servers managed by our team. We are working closely with our upstream partners, who have confirmed that patched Node.js packages are now being made available through their release channels. Our team are now working diligently to roll these updates out across our fleet. We will keep you updated.

Status: Identified We are continuing to install the available Node.js security updates on our hosting servers. Node.js will be restarted on all servers once this is complete to ensure that the new binaries are being used. Please note that patched versions of alt-nodejs v16, v18 and v20, and ea-nodejs22 are still pending from upstream. We shall continue to work with our partners to ensure that updates to these remaining versions are applied immediately once they become available. Our mitigation against Brotli-compressed requests remains in place across our hosting fleet and managed customer servers. Our upstream provider has confirmed that this reduces exposure. Our Software team are also working hard to ensure that internal applications are patched and hardened against these vulnerabilities - keeping your accounts and our systems secure is of utmost importance to us. We will continue to update you throughout the process.

Status: Identified We have completed the rollout of the available Node.js 12, 14, 22, 24 and 26 security updates across our shared hosting fleet and restarted applications using the old versions where they can restart automatically. Our customer account gateway has also been patched in production. We are now focusing on completing updates and restarts on managed customer servers. Some vendor fixes remain outstanding, so this work is not yet complete. The mitigation against Brotli-compressed requests remains in place across our hosting fleet and managed servers.

Status: Identified Security updates for the previously outstanding Node.js 16, 18 and 20 packages, and the cPanel-provided Node.js 22 package, are now available from our upstream providers. We have begun rolling these updates out across our shared hosting fleet. We are also continuing checks across managed customer servers to establish the updates and application restarts required on each server before applying the patches. This work is still in progress.

Status: Identified We have completed the rollout of all currently available alt-nodejs security updates across our shared hosting fleet. All Node.js applications on the fleet, including customer-managed processes, have now been restarted to use the updated binaries. Our final checks found no processes still using the replaced versions. The additional protection against Brotli-compressed requests remains in place across our hosting fleet and managed customer servers. Work on managed customer servers is in progress, and we are continuing to track the remaining vendor fixes. This incident remains open while that work is completed.

Status: Identified We have now applied the available Node.js security updates to managed customer servers and restarted applications using the replaced binaries. The latest audit found no outstanding package updates or processes using replaced binaries. This follows completion of the shared hosting rollout. This does not yet address every affected Node.js installation. Some older, end-of-life versions and other vendor-provided packages still have no fixes available, and customer-installed copies require separate review. Customers using their own Node.js installations should check for security updates and move unsupported versions to a patched, supported release. Our additional protection against Brotli-compressed requests remains in place, but is not a complete substitute for patched software. This incident remains open whilst we continue to monitor and await further releases from upstream.

Status: Monitoring We have completed final checks and confirmed that the available security updates for Node.js 10, 12, 14, 16, 18, 19, 20, 22, 24 and 26 have been applied across our shared hosting fleet and Managed VPS servers. We are now monitoring following the rollout. Our additional protection against Brotli-compressed requests remains in place to reduce exposure. Customers using their own Node.js installations should check for security updates and migrate unsupported versions to a patched, supported release.

Status: Resolved We have completed the rollout and final checks of all available Node.js security updates across our shared hosting fleet and Managed VPS servers. Applications using replaced binaries have been restarted, and we are closing this incident. Thank you for your patience while we completed this work.

Status: Investigating We're aware of two critical PHP security vulnerabilities announced by the PHP Security Team. Full technical details and the list of affected versions have not yet been published. Our PHP builds come from our vendors. We'll apply their patched versions across our shared hosting and Managed WordPress servers as soon as they're released. In the meantime, we're putting additional protections in place on our servers to reduce the risk until the updates are rolled out. Customers don't need to take any action. Sites will move to the patched PHP versions automatically once the updates are deployed. We'll update this notice as more information becomes available.

Status: Investigating Mitigations have been deployed fleet-wide and to customer servers that are managed by our team. We are continuing to monitor the situation closely, and are working with our upstream partners to ensure that patches are implemented as soon as they become available. We shall keep you updated throughout the process.

Status: Investigating We are continuing to monitor the situation, and are working diligently to ensure that all systems have mitigations in place in advance of applying patches released by upstream. We will share further updates in due course as and when more information is available. Thank you for your ongoing cooperation.

Status: Identified Upstream has now started releasing new versions that patch these vulnerabilities, and our team are working to get them applied to all servers and systems as soon as possible. We appreciate your ongoing cooperation and understanding, and will keep you updated.

Status: Identified Our team are continuing to roll out mitigations as quickly as possible, and we are deploying patched versions as and when they are released by upstream. Your ongoing patience and cooperation is greatly appreciated.

Status: Identified We're currently performing emergency maintenance across our fleet to make sure your sites are protected against two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Keeping your account secure is of the utmost importance to us, so we're updating PHP on every server as fixes become available. As part of this work, we're retiring PHP 4.4, 5.1 and 5.2 with immediate effect. These versions stopped receiving security fixes many years ago and cannot be protected against these issues. If your site uses PHP 4.4, 5.1 or 5.2, it may display errors or stop working. We will do everything we can to prevent this, but ensuring the security of our customers' sites takes priority. We will contact you if you are using one of the versions of PHP that are being retired. Thanks for your patience while we keep things safe.

Status: Identified Our upstream partners have now released patched PHP binaries for all supported PHP versions. Our team are working to apply this update across the fleet. We will provide an update once this is complete. Accounts utilising unsupported PHP versions are being moved on to the next possible supported version, to ensure that they also benefit from the mitigations. Once this is complete, unsupported versions will be disabled fleet-wide.

Status: Identified Information regarding package availability for patched PHP versions was miscommunication to us by upstream, and we are still awaiting their release. In the meantime, we have applied all available mitigations across the fleet, and continue to monitor. We will keep you updated. Thank you for your patience.

Status: Identified Our upstream partners have released patches for ea-php packages for supported PHP versions, and these are now applied across our shared server fleet. We are currently in the process of applying patches for alt-php packages and we are looking to roll these out as quickly as possible.

Status: Identified Upstream have made patched PHP packages available in their testing channel, and we are working on rolling this out fleet-wide. We will provide an update here once the new PHP versions have been rolled out. Thank you for your cooperation.

Status: Identified We are continuing to deploy alt-php updates fleet-wide. ea-php is already patched. We will provide an update once the rollout is complete. Work is starting on applying the same updates to customer servers that are managed by us.

Status: Identified Our team has now completed PHP updates across our entire fleet of shared, premium and reseller servers. Patching of managed servers remains in progress, and we will update you once that is completed.

Status: Identified PHP versions across all fleet and managed servers have now been updated to versions that patch the announced CVEs. Managed WordPress (Onyx) is in progress, and we will update you in due course.

Status: Identified The security fixes have been backported into the existing PHP releases, so the version number shown in cPanel, phpinfo() or WordPress Site Health won't change. ** Patched servers will still report the same PHP version (5.2–8.5) as before, but are running the fixed build. ** ** There's no need to change your PHP version or contact us to confirm your site is protected. ** Patching on Onyx is still in progress, and we'll update this notice once it's complete.

Status: Identified cPanel/WHM users - all services have now been patched - no further action is required. Important notes below: ** Patched servers will still report the same PHP version (5.2 – 8.5) as before, but are running the fixed build. ** ** There's no need to change your PHP version or contact us to confirm your site is protected. ** Onyx Users: We are still working through the patches on Onyx. We are working as quickly as possible and appreciate your continued patience. For those checking PHP versions, some will remain the same, others will update. See the expected version changes below: 7.4.33 → 7.4.33 8.0.30 → 8.0.30 8.1.30 → 8.1.34 8.2.24 → 8.2.35 8.3.12 → 8.3.36

Status: Monitoring PHP security update status: Complete All fleet servers have had PHP security updates applied, including cPanel/WHM (Web Hosting, Reseller Hosting and Business Hosting) & Managed VPS services. The patches were backported, so the PHP version number hasn’t changed. Onyx: all available PHP versions have been patched. See our earlier update for the version changes. No action is needed on your side - all available PHP versions are now secure. We’re still seeing a high volume of support queries, so replies may be delayed. We’re working through the backlog as quickly as we can.

Status: Monitoring PHP security patching is complete across Web Hosting, Reseller Hosting, Business Hosting, Managed VPS and Managed WordPress (Onyx). We are now monitoring following the rollout. No action is required from customers for these security updates. The phpMyAdmin database management tool on Onyx remains temporarily unavailable. Its PHP update is complete, but the tool will remain offline while we move it to a new hosting environment. We are tracking this separately from the PHP security rollout and do not yet have a confirmed restoration time. We appreciate your cooperation and patience over the psat 24 hours.

Status: Resolved PHP security patching is complete across Web Hosting, Reseller Hosting, Business Hosting, Managed VPS and Managed WordPress (Onyx), and we are concluding this security update notice. No action is required from customers for these security updates. Some security fixes were backported, so the PHP version displayed by your website may remain unchanged even though the fixes are installed. Onyx phpMyAdmin remains temporarily unavailable while we move it to a new hosting environment. Its PHP security update is complete; restoration is tracked separately in our phpMyAdmin maintenance notice "phpMyAdmin maintenance notice": https://krystalstatus.uk/incidents/dbharb8c. We do not yet have a confirmed restoration time. Thank you for your patience and cooperation throughout this rollout.