Security Advisory: Critical WordPress Vulnerability - "Click2Shell"
Identified - Our Engineering team continues to assess and work on the WordPress security vulnerabilities across our hosting fleet.

A new critical vulnerability, CVE-2026-87902, has been disclosed. WordPress 7.1.2 includes the security fix for this vulnerability.

Recommended Action for Customers

We strongly advise all customers managing WordPress installations to update to WordPress version 7.1.2 immediately.

We will continue to monitor the situation closely and provide further updates as new information becomes available.
Sep 23, 2026 - 02:36 EDT
Investigating - WordPress has identified a critical security vulnerability designated as "Click2Shell" affecting all WordPress versions prior to 7.1.1. This vulnerability can enable unauthenticated Remote Code Execution (RCE) when a logged-in administrator visits a specially crafted link.
Current Status & Hosting Actions

Our engineering team is currently assessing our entire hosting fleet and determining next steps.

There are currently no known workarounds for this vulnerability other than upgrading to the latest version of WordPress.

Recommended Action for Customers

We strongly advise all customers managing WordPress installations to review their environments immediately and update to WordPress version 7.1.1.

We will continue to monitor the situation closely and provide further updates as new information becomes available.
Sep 22, 2026 - 16:13 EDT
API Operational
DNS Operational
Cloud Dedicated Operational
Cloud VPS Hosting Operational
CPanel Operational
InterWorx Operational
Plesk Operational
Object Storage Operational
VMware Cloud Operational
VMware Private Cloud Operational
Business Email Operational
Load Balancers Operational
Cloud Load Balancers Operational
Shared Load Balancers - DC2 Operational
Shared Load Balancers - DC3 Operational
Shared Load Balancers - DC4 Operational
Shared Load Balancers - DC5 Operational
Network Operational
LAN Network Operational
PHX Network Operational
AMS Network Operational
Data Centers Operational
DC2 - LAN Operational
DC3 - LAN Operational
DC4 - PHX Operational
EU - AMS Operational
Management Portal Operational
Support Services Operational
Chat Operational
Case Operational
Phone Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance

Scheduled Maintenance

Scheduled Infrastructure Maintenance DC3, Lansing Sep 24, 2026 20:00 - Sep 25, 2026 00:00 EDT

During this window, our Data Center team will be performing comprehensive circuit upgrades, which requires physically accessing and powering down the entire equipment rack to ensure the work is completed safely and reliably.

This work is part of our commitment to ensuring the long-term reliability and is required to expand our data centers' cooling and power capacity.

Communications have been sent to the affected customers.

Maintenance Window: September 24th, 2026, at 10:00 PM ET
Expected Duration: Up to 4 hours
Expected Service Impact: Up to 3 hours of service interruption as we address each rack.

Our Support team will be available throughout the maintenance period should you have any questions or require assistance. You can reach us through the following channels:

Live Chat: https://portal.liquidweb.com
Email: support@liquidweb.com

We appreciate your understanding and patience as we continue to enhance our infrastructure and services.


Internal System Maintenance Reference: [CC-13753]
Posted on Sep 22, 2026 - 12:05 EDT

Scheduled Network maintenance at the DC5, Amsterdam Data Center Oct 6, 2026 11:00-16:00 EDT

Liquid Web Network Engineers will perform scheduled maintenance on the Core Network Devices and Border Network Devices supporting the Amsterdam Data Center. This work is part of our ongoing efforts to improve network connectivity, performance, reliability, and scalability.

Maintenance Window: October 6, 2026, at 11:00 AM ET
Expected Duration: Up to 5 hours

At this time, no service interruptions or increased latency are expected for customer services during the maintenance window.

Our Support team will be available throughout the maintenance period should you have any questions or require assistance. You can reach us through the following channels:

Live Chat: https://portal.liquidweb.com
Email: support@liquidweb.com

We appreciate your understanding and patience as we continue to enhance our infrastructure and services.

Thank you for your continued support.

Internal System Maintenance Reference: [CC-13765]
Posted on Sep 11, 2026 - 15:35 EDT

Scheduled Network maintenance at the DC5, Amsterdam Data Center Oct 7, 2026 11:00-16:00 EDT

Liquid Web Network Engineers will perform scheduled maintenance on the Core Network Devices and Border Network Devices supporting the Amsterdam Data Center. This work is part of our ongoing efforts to improve network connectivity, performance, reliability, and scalability.

Maintenance Window: October 7, 2026, at 11:00 AM ET
Expected Duration: Up to 5 hours

At this time, no service interruptions or increased latency are expected for customer services during the maintenance window.

Our Support team will be available throughout the maintenance period should you have any questions or require assistance. You can reach us through the following channels:

Live Chat: https://portal.liquidweb.com
Email: support@liquidweb.com

We appreciate your understanding and patience as we continue to enhance our infrastructure and services.

Thank you for your continued support.

Internal System Maintenance Reference: [CC-13765]
Posted on Sep 11, 2026 - 15:40 EDT

Sep 23, 2026

Lansing DC Rack Outage
Resolved - The affected servers are back online and operating normally. This incident has been resolved.
Sep 23, 13:38 EDT
Monitoring - Our Data Center Operations team identified the issue and immediately replaced the PSU. The affected servers are now back online and operating normally.

We are continuing to monitor the environment closely to ensure stability.

If you are still experiencing any issues, please reach out to us via Support Chat or by opening a support case, and our team will be happy to assist you.
Sep 23, 10:39 EDT
Investigating - We are currently experiencing a service disruption affecting some servers in our Lansing DC due to a rack outage. Our engineering team is actively working to resolve the issue as quickly as possible.

We appreciate your patience as our engineers work to restore full service. If you have any further questions or concerns, please contact us at support@liquidweb.com or via Live Chat.
Sep 23, 10:16 EDT

Sep 22, 2026

Sep 21, 2026

No incidents reported.

Sep 20, 2026

No incidents reported.

Sep 19, 2026

No incidents reported.

Sep 18, 2026

Acronis Plugin Security Advisory (SEC-10986) -cPanel/Plesk
Resolved - This incident has been resolved.
Sep 18, 22:15 EDT
Monitoring - The security patch for CVE-2026-87886 (SEC-10986) is applied across the affected Acronis Cyber Protect Backup plugins.

Our Engineering team continues to monitor the environment and validate the patched systems. We have not observed any new issues since our last update.

If you need assistance or have any concerns, please get in touch with our Support team.
Sep 17, 06:09 EDT
Update - The security patch for CVE-2026-87886 (SEC-10986) is being applied across the affected Acronis Cyber Protect Backup plugin.

Our engineers continue to monitor the environment and validate the patched systems. We have not observed any new issues since our last update run.

We will provide further updates as needed. Thank you for your patience and understanding.
Sep 17, 01:25 EDT
Identified - We are aware of the recent security advisory (SEC-10986) regarding the Acronis Cyber Protect Backup plugin for hosting control panels (cPanel/Plesk).

Our Engineers are actively evaluating the impact across our fleet and verifying plugin versioning. We are conducting a thorough audit to confirm full patch coverage, identify any edge cases that require manual updates, and ensure that all managed systems remain secure.

Service Disruption: None. Backups and control panel operations remain fully functional.

We are actively auditing server inventory alongside our engineering teams. Further updates will be provided as soon as the fleet-wide verification is complete
Sep 16, 10:49 EDT

Sep 17, 2026

Sep 16, 2026

Support Services Impact
Resolved - The issue affecting the third-party platform used by our Support teams has been resolved. The provider has confirmed that service stability and performance have returned to expected levels, and our teams are no longer seeing ongoing impact.

Support case access and case management functionality have returned to normal.

We apologize for the disruption and any delays this may have caused.
Sep 16, 23:12 EDT
Investigating - We are currently aware of an issue affecting a third-party platform used by our Support teams to manage and respond to client cases. The provider is actively investigating the issue and working toward a resolution.

As a result, clients may experience delays in responses to support cases while the issue is ongoing. Our teams are monitoring the situation and will continue responding to cases as quickly as possible.

We will provide further updates as more information becomes available.
Sep 16, 05:13 EDT

Sep 15, 2026

LiteSpeed security advisory
Resolved - All accessible Fully Managed and Core Managed servers running outdated versions of LiteSpeed have been successfully updated to the patched version, 6.3.7. Services have remained operational, and no additional issues have been identified during monitoring.

This incident is now resolved.

If you have any questions or concerns, please contact support@liquidweb.com.
Sep 15, 09:49 EDT
Monitoring - All accessible Fully and Core-Managed servers running outdated versions of LiteSpeed have been patched to version 6.3.7. The same webserver service that was in use before the LiteSpeed upgrade remains in use afterwards.

If you have any questions or concerns, please contact support@liquidweb.com.
Sep 15, 00:19 EDT
Investigating - WebPros (cPanel) posted news regarding a critical privilege-escalation vulnerability within the LiteSpeed software. A malicious website user could potentially gain root-level access to the server (even bypassing account isolation controls such as CageFS).

More Information can be found here:
https://support.cpanel.net/hc/en-us/articles/43483286674583-Security-LiteSpeed-Enterprise-security-advisory-September-14-2026

We will attempt to update LiteSpeed to the patched version (6.3.7) where we are able to via Automation. Regardless, please ensure your Litespeed is up-to-date.

If you have any questions or concerns, please contact support@liquidweb.com
Sep 14, 16:31 EDT
Liquidweb Portal Maintenance
Completed - The scheduled maintenance has been completed.
Sep 15, 09:00 EDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Sep 15, 08:00 EDT
Scheduled - We will be performing scheduled maintenance on the Liquidweb portal(https://portal.liquidweb.com/) on September 15, 2026, from 8:00 AM to 9:00 AM ET.

This maintenance includes updates to the portal’s checkout and payment experience, along with other improvements and updates.

The portal may experience brief interruptions during the maintenance window. No action is required.

If you have any questions or require assistance, please reach out to our support team and we will be happy to assist

Internal ref: CC-13767 & CC-13769
Sep 14, 12:56 EDT

Sep 14, 2026

Sep 13, 2026

No incidents reported.

Sep 12, 2026

No incidents reported.

Sep 11, 2026

No incidents reported.

Sep 10, 2026

No incidents reported.

Sep 9, 2026

StyleSmuggler Vulnerability – Magento & Adobe Commerce
Resolved - Our engineering teams continue to make progress on containment, investigation, and remediation across affected environments.

Adobe has released a patch addressing the underlying vulnerability. We have contacted customers running affected versions of Magento and recommend applying the appropriate security patch as soon as possible.

Customers should also review their environments and ensure their sites are clean and have not been impacted by the vulnerability.

If you have any questions or concerns. please contact Liquid Web Support so we can guide you further.
Sep 9, 18:51 EDT
Update - Our technical teams continue to make progress on containment, investigation, and remediation across affected environments.

Adobe has recently released a patch addressing the underlying vulnerability.
Our technical teams are actively reviewing, testing, and deploying the patch while continuing deep-system scans and validating safe recovery paths to restore impacted sites to a known-good state.

We will continue to share updates as new remediation details become available.
Please contact Support if you have any questions or require assistance in the meantime.
Sep 8, 02:24 EDT
Update - Our Security and Engineering teams remain actively engaged in the ongoing containment, investigation, and remediation efforts across affected environments.

Our teams continue to review scanning results, validate findings, and take appropriate remediation actions where potential compromise has been identified.

We understand the importance and urgency of this situation and appreciate your continued patience. We will provide further updates as meaningful progress is made and additional remediation details become available.

If you need assistance or have any concerns, please contact our Support team.
Sep 7, 11:06 EDT
Update - Our Security and Engineering teams continue to work on containment and remediation efforts across affected environments. Deep-system scanning remains active as we work to identify, isolate, and quarantine compromised instances.

Restoration planning is also ongoing, with our technical teams validating safe recovery paths for impacted sites. While a precise time-to-resolution is still being established, restoring full system integrity safely remains our highest priority.

We appreciate your continued patience as this work continues. We will provide another status update as soon as there are meaningful developments or milestones to share.

If you need assistance or have any concerns, please contact our Support team.
Sep 7, 02:22 EDT
Update - Our Security and Engineering teams remain actively engaged and are continuing to investigate the affected environments. Confirmed threats are being quarantined as part of our ongoing containment efforts, while findings are reviewed and validated.

We are also preparing to begin restoration work where necessary. An estimated restoration timeline is not yet available, but we will share additional details as soon as they are confirmed. This remains a high priority, and we will continue to provide updates as progress is made.
Sep 6, 17:53 EDT
Update - Our teams remain actively engaged and are continuing to investigate the Magento vulnerability and its potential impact. Security and Engineering are working closely to validate findings, expand scanning, and provide clear remediation guidance for any confirmed cases.

We understand the importance and urgency of this situation and really appreciate your patience. This remains a high priority for us, and we’re here to support you throughout the process.

We recommend continuing to monitor your environment for unusual activity or unexpected changes. If you notice anything suspicious or believe your site may have been affected, please reach out to Support.

We’ll continue to closely monitor the situation and share further updates as more information becomes available. Thank you for your patience.
Sep 6, 10:28 EDT
Update - Our security teams are actively scanning affected environments for indicators of compromise. Initial scanning has identified potential findings that are currently being reviewed and validated. We are continuing to enhance our scanning capabilities to provide additional visibility into potential compromises.

We are also reviewing affected Magento environments and developing remediation guidance for confirmed cases.

Customers may experience some impact if their storefront or applications rely heavily on GraphQL, including headless/PWA implementations.

We recommend continuing to monitor your environment for unusual activity or unexpected changes and contacting Support if you observe any issues or suspect your site may have been compromised.

Our teams will continue to monitor the situation closely and provide further updates as additional information becomes available.
Sep 6, 05:08 EDT
Update - As part of our ongoing mitigation efforts, we have implemented additional security protections across affected Magento/Adobe Commerce environments. This includes a full block on GraphQL requests to help reduce the risk of unauthorized code execution.

Customers using headless/PWA storefronts or applications that rely heavily on GraphQL may experience some impact from these protections.

At this time, there is no official vendor patch available.

We recommend continuing to monitor your site for unusual activity or unexpected changes and contacting Support if you notice any issues with your storefront or suspect your site may have been compromised. We will provide further updates once an official security patch becomes available.

Our teams are continuing to monitor the affected environments and the effectiveness of these mitigations. We will continue to assess the situation and provide additional updates as new information becomes available.
Sep 5, 19:03 EDT
Identified - We are aware of recent reports regarding a critical, unpatched zero-day vulnerability, commonly referred to as “StyleSmuggler”, affecting Magento and Adobe Commerce.

At this time, our teams are actively reviewing server environments to assess any potential impact. As a precautionary measure, our Security team is implementing the appropriate mitigations while we continue our investigation and monitor for further guidance.
We will provide further updates as more information becomes available.

If you need assistance or have any concerns, please contact our Support team .
Sep 5, 09:48 EDT
CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection
Resolved - This incident has been resolved.
Sep 9, 17:24 EDT
Update - We have completed applying the security update across our hosting fleet to servers which we are able to access and patch but there still remains a subset of servers that we were unable to patch. This is partly due to End of Life software, e.g. cPanel on CentOS 6. Customers whose servers we were unable to patch should review their servers and ensure that their servers are running one of the following patched versions of cPanel:

v11.110.0.143
v11.134.0.55
v11.136.0.39
v11.138.0.4
WP2: v11.138.1.9

Any version of cPanel which is not running one of these versions is vulnerable and should be updated.

cPanel can be updated by using the following steps:
https://docs.cpanel.net/whm/cpanel/upgrade-to-latest-version/

For the customers on CentOS 6 (or older) we strongly suggest migrating to an Alma 9 server in order to receive future security patches
Sep 9, 17:24 EDT
Monitoring - The security patch for CVE-2026-67401 is being applied across the affected hosting fleet.

Our teams continue to monitor the environment and validate the patched systems. We have not observed any new issues since our last update.

We will provide further updates as needed. Thank you for your patience and understanding.
Sep 9, 01:59 EDT
Identified - We are currently applying the available security patches for CVE-2026-67401 across our hosting fleet.
Our teams are proactively triggering manual cPanel updates on affected servers in order to bring them to a patched version.
We are continuing to work through the affected fleet and will provide additional updates as remediation progresses.
Sep 8, 18:02 EDT
Investigating - We are currently evaluating the impact of the recently released CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection and its impact on our hosting fleet.

This vulnerability impacts all versions of cPanel.

It is patched in the following versions of cPanel
v11.110.0.143
v11.134.0.55
v11.136.0.39
v11.138.0.4
WP2: v11.138.1.9
Sep 8, 14:52 EDT
Incident History Powered by Atlassian Statuspage