Current network status and maintenance

On 21 October 2026, the PHP Foundation announced two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP-based websites worldwide, including those hosted by xneelo.

Xneelo responded quickly. Before the official patches were released, we put additional recommended protections in place to reduce the risk of exploitation. Our web application firewall running on all managed servers prevented compromise via one of the known published exploits. As soon as the security updates became available, we applied them across all of our hosting servers.

Although the updates protect your website against these vulnerabilities, we cannot rule out the possibility that a website may have been compromised before the updates were applied.

What you can do

As a precaution, we recommend that you:
- Review your CMS administrator accounts and installed plugins or extensions for anything you don't recognise.
- Check your website files for unfamiliar or recently modified files, particularly in upload directories.
- Change your website administrator and FTP passwords if you suspect unauthorised access, and enable two-factor authentication where available.
- As a general precaution, update your website's CMS, plugins, themes and other software to the latest versions.

If you notice unusual activity, investigate it promptly and have your web developer make the necessary changes.