All Systems Fully Operational
Ruby Security Vulnerabilities: CVE-2026-97229 & 3 More 7hr 14min ago
Resolved
Security Update | October 24, 2026
Fusion Arc Hosting has completed its security review and verified the applicable CloudLinux Ruby security patches addressing CVE-2026-97229 & 3 More, vulnerabilities affecting the Ruby regular expression engine that could potentially allow remote code execution under certain conditions.
Security Verification Results:
- All shared hosting infrastructure nodes have been audited for the affected Ruby runtimes.
- CloudLinux security-patched Ruby versions 2.6 through 3.4 have been verified against the vendor's published fixed releases on applicable servers.
- An additional end Fully Managed VPS's have been audited and if needed customers got a patch ticket for further requirements.
- No server reboots, customer application modifications, or service restarts were performed during verification.
Legacy Ruby Versions:
Ruby 2.2, 2.3, 2.4, and 2.5 remain available on applicable servers for legacy application compatibility. However, these versions are end-of-life and have not received security patches under this advisory.
Customers using these legacy versions are strongly advised to migrate to a currently supported Ruby release and maintain updated application dependencies.
Customers remain responsible for their application configurations, compatibility, and dependencies. Fusion Arc Hosting will not automatically modify customer applications or change their selected Ruby versions. Applications may require restarting to begin using updated Ruby interpreters.
Current Security Status: CloudLinux Security Patches Verified
All applicable CloudLinux Ruby 2.6–3.4 runtime packages have been verified against the published security fixes. Separate operating-system Ruby packages remain subject to vendor-specific patch verification, while legacy Ruby versions remain unsupported for these fixes.
Additional Fully Managed VPS/VDS environments, where applicable, remain subject to individual security verification.
Fusion Arc Hosting will continue monitoring CloudLinux, AlmaLinux, and upstream Ruby security advisories and applying applicable infrastructure security updates as they become available.
We remain committed to proactive infrastructure security, protecting customer environments, and maintaining reliable hosting services.
Thank you for choosing Fusion Arc Hosting.
Security Update | October 24, 2026
Fusion Arc Hosting has completed its security review and verified the applicable CloudLinux Ruby security patches addressing CVE-2026-97229 & 3 More, vulnerabilities affecting the Ruby regular expression engine that could potentially allow remote code execution under certain conditions.
Security Verification Results:
- All shared hosting infrastructure nodes have been audited for the affected Ruby runtimes.
- CloudLinux security-patched Ruby versions 2.6 through 3.4 have been verified against the vendor's published fixed releases on applicable servers.
- An additional end Fully Managed VPS's have been audited and if needed customers got a patch ticket for further requirements.
- No server reboots, customer application modifications, or service restarts were performed during verification.
Legacy Ruby Versions:
Ruby 2.2, 2.3, 2.4, and 2.5 remain available on applicable servers for legacy application compatibility. However, these versions are end-of-life and have not received security patches under this advisory.
Customers using these legacy versions are strongly advised to migrate to a currently supported Ruby release and maintain updated application dependencies.
Customers remain responsible for their application configurations, compatibility, and dependencies. Fusion Arc Hosting will not automatically modify customer applications or change their selected Ruby versions. Applications may require restarting to begin using updated Ruby interpreters.
Current Security Status: CloudLinux Security Patches Verified
All applicable CloudLinux Ruby 2.6–3.4 runtime packages have been verified against the published security fixes. Separate operating-system Ruby packages remain subject to vendor-specific patch verification, while legacy Ruby versions remain unsupported for these fixes.
Additional Fully Managed VPS/VDS environments, where applicable, remain subject to individual security verification.
Fusion Arc Hosting will continue monitoring CloudLinux, AlmaLinux, and upstream Ruby security advisories and applying applicable infrastructure security updates as they become available.
We remain committed to proactive infrastructure security, protecting customer environments, and maintaining reliable hosting services.
Thank you for choosing Fusion Arc Hosting.
Resolved
Security Update | October 24, 2026
Fusion Arc Hosting has completed its security review and successfully verified mitigation measures for ZDI-CAN-33367, a critical Linux kernel local privilege escalation vulnerability that could allow unauthorized root level access.
Security Verification Results:
- All shared hosting infrastructure nodes have been verified as protected against the documented unprivileged-user exploitation path.
- End customer Fully Managed VPS's have been successfully mitigated and verified.
- The recommended
- No server reboots, customer application modifications, or service interruptions were required to implement or verify these protections.
Current Security Status: Mitigated
The documented exploitation path has been blocked across the verified servers. A permanent kernel security patch is still pending vendor availability and deployment.
Fusion Arc Hosting will continue monitoring CloudLinux, AlmaLinux, and KernelCare security releases and will apply applicable permanent fixes as they become available.
Additional Fully Managed VPS/VDS environments, where applicable, remain subject to individual security verification.
We remain committed to proactive infrastructure security, protecting customer environments, and maintaining reliable hosting services.
Thank you for choosing Fusion Arc Hosting.
Security Update | October 24, 2026
Fusion Arc Hosting has completed its security review and successfully verified mitigation measures for ZDI-CAN-33367, a critical Linux kernel local privilege escalation vulnerability that could allow unauthorized root level access.
Security Verification Results:
- All shared hosting infrastructure nodes have been verified as protected against the documented unprivileged-user exploitation path.
- End customer Fully Managed VPS's have been successfully mitigated and verified.
- The recommended
user.maxusernamespaces = 0 restriction is active and persistently configured across all audited servers.- No server reboots, customer application modifications, or service interruptions were required to implement or verify these protections.
Current Security Status: Mitigated
The documented exploitation path has been blocked across the verified servers. A permanent kernel security patch is still pending vendor availability and deployment.
Fusion Arc Hosting will continue monitoring CloudLinux, AlmaLinux, and KernelCare security releases and will apply applicable permanent fixes as they become available.
Additional Fully Managed VPS/VDS environments, where applicable, remain subject to individual security verification.
We remain committed to proactive infrastructure security, protecting customer environments, and maintaining reliable hosting services.
Thank you for choosing Fusion Arc Hosting.
Investigating Node JS - CVE-2026-105482 on 23 Oct 2026 09:48:47 (UTC-06:00)
Resolved 7hr 59min ago
Security Update | October 24, 2026
Fusion Arc Hosting has completed its Node.js security patch verification across our four shared hosting infrastructure nodes and end customers Fully Managed VPS & VDS servers.
Verification Results:
- Node.js 22.23.4 and 24.22.1 security releases are installed wherever these runtimes are provided.
- CloudLinux security-backported packages for Node.js 10, 12, 14, 16, 18, 19, and 20 have been verified against the vendor's published fixes.
Legacy Node.js Versions:
Node.js 6, 8, 9, and 11 remain available on applicable servers for legacy application compatibility. However, these versions are end-of-life and have not received security patches for this advisory.
Customers using these legacy versions are strongly advised to migrate to a currently supported Node.js release, such as Node.js 22 or 24 where available, and update their application dependencies.
Customers are responsible for managing their application versions, compatibility, and dependencies. Fusion Arc Hosting will not automatically modify customer application configurations or change their selected Node.js versions. Applications may also require a restart to begin using updated server-provided runtimes.
Current Status: Shared-Infrastructure CloudLinux runtime package verification is complete. Verification of separate operating-system Node.js packages and Fully Managed VPS/VDS environments is also completed.
We will continue monitoring vendor security advisories and providing updates as necessary.
Thank you for choosing Fusion Arc Hosting.
Security Update | October 24, 2026
Fusion Arc Hosting has completed its Node.js security patch verification across our four shared hosting infrastructure nodes and end customers Fully Managed VPS & VDS servers.
Verification Results:
- Node.js 22.23.4 and 24.22.1 security releases are installed wherever these runtimes are provided.
- CloudLinux security-backported packages for Node.js 10, 12, 14, 16, 18, 19, and 20 have been verified against the vendor's published fixes.
Legacy Node.js Versions:
Node.js 6, 8, 9, and 11 remain available on applicable servers for legacy application compatibility. However, these versions are end-of-life and have not received security patches for this advisory.
Customers using these legacy versions are strongly advised to migrate to a currently supported Node.js release, such as Node.js 22 or 24 where available, and update their application dependencies.
Customers are responsible for managing their application versions, compatibility, and dependencies. Fusion Arc Hosting will not automatically modify customer application configurations or change their selected Node.js versions. Applications may also require a restart to begin using updated server-provided runtimes.
Current Status: Shared-Infrastructure CloudLinux runtime package verification is complete. Verification of separate operating-system Node.js packages and Fully Managed VPS/VDS environments is also completed.
We will continue monitoring vendor security advisories and providing updates as necessary.
Thank you for choosing Fusion Arc Hosting.
Investigating on 23 Oct 2026 09:48:47 (UTC-06:00)
We are actively monitoring Node.js security advisory CVE-2026-105482. Our team is currently reviewing and verifying all Fully Managed infrastructure—including client-managed VPS and VDS environments—to ensure all necessary security patches are applied.
We are actively monitoring Node.js security advisory CVE-2026-105482. Our team is currently reviewing and verifying all Fully Managed infrastructure—including client-managed VPS and VDS environments—to ensure all necessary security patches are applied.
Degraded Performance Tickets Support and Sales Teams on 22 Oct 2026 16:54:06 (UTC-06:00)
Completed on 23 Oct 2026 08:18:23 (UTC-06:00)
Support and sales are back to normal.
Support and sales are back to normal.
Monitoring on 22 Oct 2026 16:54:06 (UTC-06:00)
We are currently experiencing higher-than-usual support volume due to inquiries regarding the recent PHP vulnerability.
Our team is actively working through tickets, but response times may be slightly delayed. We appreciate your patience and understanding.
We are currently experiencing higher-than-usual support volume due to inquiries regarding the recent PHP vulnerability.
Our team is actively working through tickets, but response times may be slightly delayed. We appreciate your patience and understanding.
Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 on 21 Oct 2026 16:36:10 (UTC-06:00)
Resolved on 22 Oct 2026 00:59:42 (UTC-06:00)
All customers Fully Managed Servers have been patched along with all our Fully Managed hosting services.
All customers Fully Managed Servers have been patched along with all our Fully Managed hosting services.
In progress on 21 Oct 2026 16:36:10 (UTC-06:00)
We’re aware of the global PHP CVE's and have been working with software vendors to patch the issue.
We are working on patching all Fully Managed web hosting, reseller hosting, agency hosting, semi dedicated servers along with all Fully Managed cPanel VPS and VDS servers.
We’re aware of the global PHP CVE's and have been working with software vendors to patch the issue.
We are working on patching all Fully Managed web hosting, reseller hosting, agency hosting, semi dedicated servers along with all Fully Managed cPanel VPS and VDS servers.