Scheduled Shared Hosting Maintenance – November 12, 2026

Status: Scheduled
Maintenance Window: Thursday, November 12, 2026, 1:00–3:00 AM EST
Expected Downtime: Approximately 15–20 minutes

Reliable Penguin will be performing scheduled upgrades to portions of our shared hosting infrastructure during the early morning hours of Thursday, November 12.

We anticipate minimal disruption, with approximately 5–10 minutes of service interruption expected during the maintenance window.

No action is required from customers.

If you experience any issues following the maintenance, please contact our support team at support@reliablepenguin.com.

Thank you for your patience and understanding as we continue improving our hosting infrastructure.

Reliable Penguin Support Team

Critical PHP Security Advisory – October 21, 2026

Update – October 21, 2026, 3:00 PM Eastern

Status: Security Updates Available – Deployment in Progress

PHP developers and third-party package maintainers have now made security updates available for PHP versions 7.4 through 8.5, including patches for older PHP releases that are no longer officially supported by the PHP development team.

Reliable Penguin has obtained the applicable security updates, and they have either been installed or are currently being installed across all Reliable Penguin managed servers.

Our operations team is continuing to monitor the deployment process and verify successful installation of the security updates.

No action is required from customers using Reliable Penguin's managed hosting services at this time. We will provide additional updates if further action becomes necessary.

Published: October 21, 2026

The PHP development team has announced an emergency security release addressing two critical vulnerabilities in PHP, the programming language used by WordPress, Drupal, and many other web applications.

Both vulnerabilities have been assigned a critical severity rating of 9.2 out of 10. Security researchers have indicated that these vulnerabilities may allow remote code execution, potentially permitting attackers to execute unauthorized commands on affected servers.

The PHP project has scheduled the release of security patches for Wednesday, October 21, 2026, at 10:00 AM Eastern Time.

Reliable Penguin's Response

Reliable Penguin is monitoring this developing security issue and preparing to apply the necessary updates to affected systems under our management.

Our response includes:

• Reviewing official PHP security announcements and affected versions.
• Identifying PHP installations that require updates.
• Prioritizing internet-facing production servers.
• Applying security patches as soon as supported updates become available and can be safely deployed.
• Monitoring for additional security guidance and potential exploitation.

Security updates may require PHP service restarts or brief interruptions to affected applications. We will work to minimize any service disruption.

What Customers Need to Know

Customers using Reliable Penguin's managed hosting services generally do not need to take immediate action. Our operations team will coordinate applicable server-level security updates.

Customers operating older, unsupported PHP versions or managing their own application environments may require additional remediation or application compatibility testing.

PHP versions 8.1 and earlier are no longer supported by the PHP development team. Customers using these versions should plan to migrate to a supported release.

Current Security Status

At the time of this advisory, the PHP project has not yet released the full technical details or confirmed the complete list of affected versions.

We are not aware of confirmed widespread exploitation at this time. However, given the critical severity of these vulnerabilities, we are treating this as a high-priority security event.

Further Updates

Reliable Penguin will update this advisory as additional information becomes available and remediation progresses.

Additional Information:

• Official PHP Security Announcement
• PHP Supported Versions
• The Hacker News – PHP2Shell Critical Vulnerabilities

Posted: June 3, 2026
Category: Security Advisory
Severity: High for public HTTP/2 endpoints

Reliable Penguin is aware of public reports regarding CVE-2026-49975, also referred to as the HTTP/2 Bomb vulnerability.

This issue may allow a remote attacker to exhaust server memory on affected HTTP/2-enabled web servers, potentially causing service disruption or denial of service. Public reporting indicates that the issue relates to HTTP/2 header compression behavior and may affect multiple web server and proxy implementations, including NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora.

Current status

Reliable Penguin is reviewing managed server environments and applying appropriate mitigations.

At this point, no customer action is necessary.

We will provide updates as they become available.

What customers should do

No action is required from Reliable Penguin managed hosting customers at this time.

Customers with questions may open a support request through the Reliable Penguin help desk.

References

• The Hacker News: “New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare” , published June 3, 2026.
• Calif: “Codex Discovered a Hidden HTTP/2 Bomb” , published June 2, 2026.
• mod_http2 release notes: Version 2.0.41 release notes , noting a fix for cookie header accounting against LimitRequestFields.

Reliable Penguin has reviewed managed WordPress servers for a recently disclosed vulnerability in the Advanced Custom Fields: Extended WordPress plugin, also commonly referred to as ACF Extended or ACFE.

Summary

Wordfence published an advisory for a critical unauthenticated privilege escalation vulnerability in the Advanced Custom Fields: Extended WordPress plugin. The issue affects Advanced Custom Fields: Extended versions up to and including 0.9.2.5 and is patched in version 0.9.2.6. Wordfence assigned the vulnerability a CVSS score of 9.8, which is considered critical.

According to Wordfence, the vulnerability may allow an unauthenticated attacker to escalate privileges by abusing validation handling related to the _acf_post_id parameter. The advisory notes that exploitation depends on site configuration, specifically whether the site exposes a public ACFE frontend form configured with a Create User action that maps a role field.

Reliable Penguin Response

Reliable Penguin used our internal RP Anvil system to review managed servers for WordPress installations using vulnerable Advanced Custom Fields: Extended plugin versions.

As part of this review, RP Anvil scanned managed systems for Advanced Custom Fields: Extended plugin installations and checked installed versions against the vulnerable range identified in the advisory.

At this time:

• Managed servers have been reviewed.
• Clients with potentially vulnerable WordPress installations have been notified directly.
• No client action is required at this point for Reliable Penguin managed systems unless we have contacted you directly.

What Clients Should Do

For Reliable Penguin managed systems, no action is required unless you have received a direct notification from us.

For WordPress sites not managed by Reliable Penguin, site owners should review their installations and update Advanced Custom Fields: Extended to version 0.9.2.6 or newer. Wordfence recommends updating as soon as possible due to the critical nature of this vulnerability.

Site owners should also review any public ACFE frontend forms, especially forms configured to create users or assign user roles.

Additional Resources

• Wordfence Intelligence: Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation
• Advanced Custom Fields: Extended plugin page on WordPress.org

Questions

If you have questions about this vulnerability or your managed WordPress environment, please contact Reliable Penguin support.

Reliable Penguin has reviewed managed WordPress servers for a recently disclosed vulnerability in the Kirki WordPress plugin.

Summary

Wordfence published an advisory for a critical unauthenticated privilege escalation vulnerability in the Kirki WordPress plugin. The issue affects Kirki versions 6.0.0 through 6.0.6 and is patched in version 6.0.7. Wordfence assigned the vulnerability a CVSS score of 9.8, which is considered critical.

According to Wordfence, the vulnerability can allow an unauthenticated attacker to take over user accounts, including administrator accounts, by abusing the plugin’s password reset functionality.

Reliable Penguin Response

Reliable Penguin used our internal RP Anvil system to review managed servers for WordPress installations using vulnerable Kirki plugin versions.

As part of this review, RP Anvil scanned managed systems for Kirki plugin installations and checked installed versions against the vulnerable range identified in the advisory.

At this time:

• Managed servers have been reviewed.
• Clients with vulnerable WordPress installations have been notified directly.
• No client action is required at this point for Reliable Penguin managed systems unless we have contacted you directly.

What Clients Should Do

For Reliable Penguin managed systems, no action is required unless you have received a direct notification from us.

For WordPress sites not managed by Reliable Penguin, site owners should review their installations and update Kirki to version 6.0.7 or newer. Wordfence recommends updating as soon as possible due to the critical nature of this vulnerability.

Additional Resources

• Wordfence: Unauthenticated Privilege Escalation Vulnerability Patched in Kirki WordPress Plugin
• Wordfence Intelligence vulnerability summary for Kirki
• Kirki plugin page on WordPress.org

Questions

If you have questions about this vulnerability or your managed WordPress environment, please contact Reliable Penguin support.