POP3 and SSH Service Down Alerts on Multiple Servers

Incident Report for Liquid Web - Services

Resolved

This incident has been resolved. We have successfully mitigated the impact caused by the ThreatDown update and are observing stability across our fleet.

If you have ThreatDown installed and continue to experience issues—such as your server being unresponsive or down—please reboot your server via the management portal at my.liquidweb.com and reach out to our support team for further assistance.
Posted Feb 03, 2026 - 13:56 EST

Update

We are continuing to see stability across the fleet and have not observed any recent alerts related to this issue. Our team has been actively working on this incident to apply the fix across the affected servers, and we have made solid progress so far, with completion on the impacted list.

We are actively monitoring the situation and will keep this space updated as soon as we have further information available.

If you believe your system may be affected or require assistance, please chat with us or submit a ticket at my.liquidweb.com.

Thank you for your understanding and patience!
Posted Feb 01, 2026 - 23:52 EST

Update

We are making steady progress by implementing necessary fixes and working closely with ThreatDown to find a lasting solution. The systems are stabilizing, and we are in good shape to manage the situation.

We will continue to monitor the situation and share further updates as they become available. Please contact support if you experience any issues. Thank you for your patience.
Posted Feb 01, 2026 - 00:17 EST

Update

At this time, we have downgraded the severity of this incident. Our teams remain actively engaged and continue to monitor the affected systems. Any new issues will be addressed by applying the mblinux-updater-fix, followed by a server reboot as needed. We are also continuing to work closely with ThreatDown support toward a permanent resolution.

If you experience any service interruptions, please don’t hesitate to reach out via chat or submit a support ticket through your customer portal at my.liquidweb.com. We appreciate your patience and understanding as our teams work through this, and we’ll provide further updates as they become available.
Posted Jan 30, 2026 - 19:41 EST

Update

Our team is actively working to resolve the issue by running the mblinux-updater-fix,  which has proven effective when combined with a server reboot. Based on ongoing service alerts, we are applying this fix where required and closely monitoring affected systems to ensure stability.

We are actively working with ThreatDown to identify the best permanent resolution and outline next steps. If you believe your system may still be affected or you experience any service interruption, please contact us via chat or submit a support ticket at my.liquidweb.com.

Further updates will be provided as they become available.
Posted Jan 30, 2026 - 08:57 EST

Monitoring

Our team has made progress by applying the fix to the affected servers. We have been working closely with the ThreatDown team to obtain the latest updates from their side in order to address this issue. We will continue to monitor the situation and take action where necessary.

If you believe your system may be affected or you are experiencing a service interruption, please contact us via chat or submit a support ticket at my.liquidweb.com.

We will provide further updates as they become available.

Thank you for your patience and support.
Posted Jan 29, 2026 - 23:40 EST

Update

We have identified the issue and confirmed it impacts a subset of services with the ThreatDown (TD) add-on enabled. WE have additional resources engaged with Threat Stack. Our team is working through and applying manual fixes to servers that we have been able to identify as affected by this incident.

We’ll provide additional updates as they become available.

If you believe your system is impacted or are experiencing a service interruption, please chat with us or submit a ticket at my.liquidweb.com.

Thank you for your patience and support.
Posted Jan 29, 2026 - 20:18 EST

Update

Our team is actively addressing impacted systems and working to restore service as quickly as possible.

If you believe your system is affected or need assistance, please chat with us or submit a ticket at my.liquidweb.com.

Thank you for your patience and support.
Posted Jan 29, 2026 - 17:07 EST

Update

We’ve identified the issue and confirmed it impacts a subset of services with the ThreatDown (TD) add-on enabled. Our team is actively identifying affected systems and deploying a fix as quickly as possible.

We’ll provide additional updates as they become available.

If you believe your system is impacted or are experiencing a service interruption, please chat with us or submit a ticket at my.liquidweb.com.

Thank you for your patience and support.
Posted Jan 29, 2026 - 11:25 EST

Update

The issue has been identified and is affecting only services with the ThreatDown (TD) add-on enabled. Our Support team is actively working to implement a fix as quickly as possible.

We appreciate your patience and understanding. Further updates will be shared here as they become available.

If you need assistance, please chat with us or submit a ticket at my.liquidweb.com. Thank you for your patience and understanding. We appreciate your support.
Posted Jan 29, 2026 - 10:27 EST

Identified

The issue has been identified, and our Support team is actively working to implement the fix as quickly as possible.

We appreciate your patience and understanding. Further updates will be shared here as they become available.
Posted Jan 29, 2026 - 00:08 EST

Investigating

We are currently investigating the POP3 and SSH service down alerts on a subset of servers. The issue appears to have occurred after an endpoint update on the Mbdaemon associated with the Threatdown add-on service.

Our engineering team is actively working to identify the root cause and resolve the issue.

If you need assistance, please chat with us or submit a ticket at my.liquidweb.com. Thank you for your patience and understanding. We appreciate your support.
Posted Jan 28, 2026 - 23:06 EST
This incident affected: Cloud Dedicated and Cloud VPS Hosting.