Resolved -
We have taken steps to prohibit execution of files exploiting the "PolyShell" unrestricted file upload vulnerability on a subset of servers in our environment. We have sent a ticket to all customers we've protected identifying the servers and paths involved.
If you have any questions or concerns. You can reach us through the following channels:
Monitoring -
Following our investigation, we are implementing a mitigation measure for Magento 2 installations on our Managed hosting platform for which we have access between 21:00 EDT and 23:00 EDT tonight.
We have sent a ticket to all customers with servers where mitigations will be applied. For these customers, we will be deploying an .htaccess file to block direct web-request access to the uploads directory. This change is expected to have minimal impact. If your site has been customised to serve or process requests through the upload directory, this functionality will be affected. Please contact us with any questions.
Customers with Magento2 websites who did not receive a ticket should review the Sansec article below announcing this vulnerability and apply the recommended changes:
We appreciate your patience and understanding.
Mar 18, 20:15 EDT
Investigating -
We are aware of recent reports regarding a potential unrestricted file upload vulnerability, commonly referred to as “PolyShell”, affecting Magento and Adobe Commerce.
At this time, our teams are actively reviewing server environments to assess any potential impact and determine whether any systems/customer sites may be affected.
We will provide further updates as more information becomes available. If you have any questions or concerns. You can reach us through the following channels:
Resolved -
The ClamAV signature updates have been successfully applied, and systems are operating as expected.
We will continue to monitor as part of normal operations.
If you have any questions, please chat with us or create a support ticket via my.liquidweb.com.
We appreciate your patience and understanding.
Mar 19, 09:46 EDT
Update -
We have automated the ClamAV signature database updates for all impacted servers, and the deployment is currently still in progress.
Based on the results so far, systems appear to have already received the updated signatures and are functioning as expected. We are continuing to monitor the automation to ensure completion across all hosts.
We will provide a final update once the process has fully completed.
If you have any questions, please chat with us or create a support ticket via my.liquidweb.com.
We appreciate your patience and understanding.
Mar 18, 09:55 EDT
Update -
We have automated the ClamAV signature database updates for all impacted servers. Deployment is currently underway, and we will provide another update once the process is completed.
If you have any questions, please chat with us or create a support ticket via my.liquidweb.com. We appreciate your patience and understanding.
Mar 17, 02:06 EDT
Identified -
We have identified the cause of the issue affecting the ClamAV service. A recent malware signature update introduced an invalid entry in the ClamAV signature database, which can prevent the clamd service from restarting successfully.
Our team is currently applying a signature database refresh on affected servers to remove the invalid entry and restore normal operation of the ClamAV service.
We are currently applying this fix across all affected servers and will provide another update once the process is completed.
Mar 16, 14:07 EDT
Investigating -
We are currently investigating an issue affecting the ClamAV service, where clamd restarts may fail due to a problematic signature update. Our System Engineering team is actively working to identify the root cause and implement a fix.
This issue may affect Maldet scans and cause mail delivery failures if the ClamAV service is not running.
Mar 16, 13:22 EDT
Resolved -
Our Engineering team has fully resolved the earlier connectivity issue that was impacting Provisioning servers.
All services have been restored, and workflows are operating normally. Corrective measures have been implemented to address the root cause and help prevent recurrence.
Thank you for your patience and understanding throughout this process.
If you need further assistance, please reach out via Live Chat or open a ticket through the my.liquidweb.com portal.
Thank you
Mar 19, 09:32 EDT
Update -
Our Engineering team has identified and are working on fully resolving the root cause of the earlier connectivity issue affecting Provisioning servers.
Services have been restored, and workflows are now progressing normally. We are continuing to actively monitor the environment to ensure ongoing stability and performance.
Thank you for your patience and understanding throughout this process.
Need help? Chat with us or create a ticket via my.liquidweb.com.
Mar 18, 20:08 EDT
Monitoring -
Update: Our Engineers have identified the root cause of the earlier connectivity issue impacting Provisioning servers and Storm parent communication with RabbitMQ (RMQ) hubs.
At this time, connectivity has been restored and workflows are progressing. Our team continues to monitor the environment closely to ensure ongoing stability.
We appreciate your patience and understanding throughout this process.
Need help? Chat with us or create a ticket via my.liquidweb.com.
Mar 18, 10:18 EDT
Identified -
Our Engineers have identified the issue and are currently troubleshooting the connectivity failure where Provisioning servers and Storm parents are unable to connect to their respective RabbitMQ (RMQ) hubs.
We appreciate your patience and understanding as we work to restore this service. Thank you. Need help? Chat with us or create a ticket via my.liquidweb.com.
Mar 18, 08:41 EDT
Update -
We have expanded the scope of our investigation as we identify impacts on core workflows, specifically on; Order Processing: New orders are being accepted, but cannot be processed at this time. Storm Workflows: All active provisioning workflows are currently stalled.
Our engineering team is actively investigating the root cause. Further updates will be posted here as they become available.
Mar 18, 04:07 EDT
Investigating -
On our Cloud VPS and Cloud Dedicated hosting platforms, certain provisioning workflows are failing to execute hard reboots and might affect resize, backup process, and firewall rule updates. The servers themselves are still online, but a provisioning workflow will be affected by this issue. Our Engineers are investigating the issue, and we will share the updates here.
Need help? Chat with us or create a ticket via my.liquidweb.com.
We appreciate your patience and understanding as we work to restore this service. Thank you.
Mar 18, 02:34 EDT
Completed -
The scheduled maintenance has been completed.
Mar 18, 12:00 EDT
In progress -
Scheduled maintenance is currently in progress. We will provide updates as necessary.
Mar 18, 08:00 EDT
Scheduled -
Our Systems Engineers will be performing scheduled background maintenance on VMware vCenter services in DC3.
This maintenance is part of routine platform improvements. No service interruption or customer impact is expected. Virtual machines (VMs) will remain fully operational throughout the maintenance window.
Our team will be actively monitoring the environment to ensure continued stability.
If you need assistance, please chat with us or create a support ticket via my.liquidweb.com.
Completed -
The scheduled maintenance has been completed.
Mar 16, 11:00 EDT
In progress -
Scheduled maintenance is currently in progress. We will provide updates as necessary.
Mar 16, 10:00 EDT
Scheduled -
We will be performing scheduled network maintenance to improve the performance and stability of our network infrastructure.
No customer impact is expected during this maintenance period. All work is being performed under strict change controls and will be closely monitored by our engineering teams to ensure a smooth and seamless experience.
Our support team is available if you need assistance, have questions, or have any concerns. You can reach us via live chat, submit a support ticket, or email us at support@liquidweb.com.
We appreciate your understanding and patience as we work to provide you with better service.
Internal System Maintenance Reference: [CC-13265]
Mar 13, 17:00 EDT
Completed -
The scheduled maintenance has been completed.
Mar 12, 00:00 EDT
In progress -
Scheduled maintenance is currently in progress. We will provide updates as necessary.
Mar 11, 20:00 EDT
Scheduled -
Scheduled maintenance will be performed on servers that store customer VPS images in the Lansing Data Center as part of ongoing infrastructure improvements.
A 4-hour maintenance window has been scheduled to complete this work in coordination with Data Center Operations.
During this maintenance window, customers may be unable to create new VPS instances from existing images while the maintenance is in progress.
Existing VPS instances and other services will remain unaffected.
Our teams are here to help you. Please do not hesitate to get help via Chat or Case at my.liquidweb.com.
Completed -
The scheduled maintenance has been completed.
Mar 11, 12:00 EDT
In progress -
Scheduled maintenance is currently in progress. We will provide updates as necessary.
Mar 11, 08:00 EDT
Scheduled -
Our Systems Engineers will be performing scheduled background maintenance on VMware vCenter services in DC4.
This maintenance is part of routine platform improvements. No service interruption or customer impact is expected. Virtual machines (VMs) will remain fully operational throughout the maintenance window.
Our team will be actively monitoring the environment to ensure continued stability.
If you need assistance, please chat with us or create a support ticket via my.liquidweb.com.
Our team has completed patching the W3 Total Cache plugin across all managed systems where the update was possible based on the current WordPress and PHP version requirements.
In cases where the patch could not be applied due to compatibility constraints or other configuration limitations, the affected clients have been contacted directly with the relevant details and recommended next steps. In most instances, this involves upgrading the underlying WordPress and/or PHP versions before updating the plugin.
At this time, the planned remediation work has been completed and this matter is considered resolved.
Recommended Action
Clients with sites running W3 Total Cache version 2.9.1 or earlier are encouraged to update to the patched version 2.9.2 as soon as possible. Where the update is not currently possible due to WordPress or PHP version constraints, please upgrade those components first and then proceed with the plugin update.
If you require assistance with completing the update, please contact our support team.
Thank you for your patience and understanding while we worked to address this matter.
Mar 10, 02:28 EDT
Monitoring -
Update Our team has now applied patches to all instances of the W3 Total Cache plugin across our managed systems where the update was possible based on the current WordPress and PHP version requirements. In some environments, the patch could not be applied as the underlying WordPress or PHP versions do not meet the minimum compatibility requirements for the updated plugin, or due to other configuration limitations. These instances will require updates at the application or environment level before the plugin can be upgraded. For cases where the patch could not be applied for the reasons mentioned above, we will be reaching out to the affected clients directly with additional details and recommended next steps.
Recommended Action Clients with sites running W3 Total Cache version 2.9.1 or earlier are strongly advised to update to the patched version 2.9.2 as soon as possible. Where the plugin update is not currently possible due to WordPress or PHP version constraints, we recommend upgrading WordPress and/or PHP first, and then completing the update to W3 Total Cache version 2.9.2 or later at the earliest opportunity.
If you require assistance with upgrading your environment or applying the update, please contact our support team, who will be happy to assist. We will continue to monitor this matter and will provide further updates here should any additional actions be required.
Mar 9, 04:10 EDT
Identified -
We have been made aware of a critical vulnerability, CVE-2026-27384, affecting versions equal to or less than 2.9.1, of the WordPress W3 Total Cache plugin.
Recommended Action We strongly encourage all clients to update any sites running versions 2.9.1 or older to the patched version 2.9.2 immediately.
Current Status Exploit Availability: There are currently no known public Proof of Concept (PoC) exploits for this vulnerability.
Our team is currently applying patches to instances of outdated W3TC plugins that we were able to identify on our managed systems. You may receive server login notifications from internal IPs as we patch detected W3TC installations.
We will provide further updates as they become available. If you have any questions or require assistance with the update, please reach out to our support team.
Mar 6, 15:20 EST
Investigating -
We have been made aware of a critical vulnerability, CVE-2026-27384, affecting versions equal to or less than 2.9.1, of the WordPress W3 Total Cache plugin.
Recommended Action We strongly encourage all clients to update any sites running versions 2.9.1 or older to the patched version 2.9.2 immediately.
Current Status Exploit Availability: There are currently no known public Proof of Concept (PoC) exploits for this vulnerability.
Our team is assessing the impact on our managed sites and evaluating the deployment of necessary patches across our managed systems.
We will provide further updates as they become available. If you have any questions or require assistance with the update, please reach out to our support team.
Mar 6, 13:21 EST