RESOLVED - Critical PHP Security Vulnerabilities – CVE-2026-109618 & CVE-2026-109619 Resolved Fault / Issue
Scheduled on 21/10/2026 08:00:00 Estimated finish 21/10/2026 08:00:00

We are aware of two critical PHP security vulnerabilities disclosed ahead of today's scheduled security release at 14:00 UTC (16:00 CEST).

Our Operations team is actively assessing affected environments, implementing preventive security measures where possible, and preparing for the deployment of security patches as soon as they become available.

We are also investigating remediation options for older PHP versions that are no longer officially supported.

We are closely monitoring the situation and will provide regular updates on this page as remediation progresses.

No action is currently required from customers for PHP environments managed by Hosted Power. If specific action is needed, we will contact you directly.

PHP environments

RESOLVED - Degraded network performance Finished
Scheduled on 05/10/2026 17:20:00 Estimated finish 05/10/2026 19:30:00

There is degraded network performance detected in our datacenter in Amsterdam. We're currently investigating the issue

some of the servers in Amsterdam datacenter

Magento CVE-2026-75650 Security Update Finished
Scheduled on 09/09/2026 10:44:00 Estimated finish 09/09/2026 10:44:00

We are rolling out an NGINX mitigation for the actively exploited Magento vulnerability CVE-2026-75650 (StyleSmuggler).
The mitigation blocks suspicious GraphQL requests containing the styles flag before they reach Magento.

For the permanent fix, please apply Adobe's official patch:
https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146

The temporary NGINX mitigation is added through:
nginx/magento-CVE-2026-75650-fix.conf

If this mitigation cannot or should not be used, remove the file and reload NGINX:
rm -f nginx/magento-CVE-2026-75650-fix.conf
tscli nginx reload