Hosting Service Status & Security Updates

Service transparency

A record of service availability, maintenance and security updates from XYZulu.

Last updated11 November 2026

All systems operational

We are not currently tracking any active incidents.

Looking for help with your service? Contact our team.

Service components

Web Hosting
Operational
Control Panel
Operational
Backups
Operational

Incident history

30 October 2026 – Ubuntu CVE-2026-98432 Fix Applied #

Resolved Security Posted: 30 October 2026 · Updated: 11 November 2026

We have completed applying the fix for CVE-2026-98432 across affected systems.

  • Current status: Remediation complete.
  • Impact: No customer action required.

29 October 2026 – WordPress 7.1.4 Security Update Installed Across All Sites #

Resolved Security Maintenance Posted: 29 October 2026

We installed WordPress 7.1.4 across all sites. This release fixes multiple security issues, including:

  • Remote code execution: A weakness in the WordPress upgrade process that could allow remote code execution during the upgrade window.
  • Cross-site scripting (XSS): Multiple stored XSS issues affecting specially crafted block markup, the Interactivity API, Privacy Data Removal Requests, Customizer selective refresh, Categories, user logins, playlists and image blocks, and comments pagination blocks.
  • Other security issues: A stored denial-of-service issue in the Interactivity API, exposure of unpublished Customizer changesets to unauthenticated users, and notes visible to privileged users without permission to edit the associated post.
  • Certificate trust: Updated bundled root certificates following the eMudhra revocation.
  • Impact: No customer action required; all sites are running the updated version.

28 October 2026 – Tailscale Security Bulletin TS-2026-017 #

Resolved Security Posted: 28 October 2026

We reviewed Tailscale Security Bulletin TS-2026-017.

  • Mitigation: Tailscale was updated across our fleet.
  • Impact: No customer action required.
  • Current status: Services remain protected.

27 October 2026 – NGINX Update and Certificate Store Update #

Resolved Security Maintenance Posted: 27 October 2026

We completed proactive security maintenance across our platform.

  • NGINX update: Upgraded NGINX across the server fleet to the latest stable release (1.30.6).
  • Certificate store update: Updated trust stores in response to the eMudhra certificate compromise notice from Cloudflare (details).
  • Impact: No customer action required.
  • Current status: Services remain protected.

25 October 2026 – CVE-2026-111497 Security Patch Applied #

Resolved Security Completed: 24 October 2026

We have applied patches across our platform to address CVE-2026-111497.

  • Impact: No customer action required.
  • Current status: Services remain protected.

22 October 2026 – Critical PHP Security Release #

Resolved Security Posted: 22 October 2026

A critical security update was released for PHP (see the official PHP announcement).

  • 12:45 AM – Firewall rules were installed to block the vulnerability.
  • 6:00 AM (approx.) – PHP was patched across all servers.

No action is required from you. Your services remain protected.