Notice of planned downtime
ALCO USA Inc will apply critical PHP security updates to every website and application we host, starting at 6:00 PM Mountain Time today, Wednesday, October 21, 2026. These updates are being enforced on all servers under ALCO management.
Websites and applications hosted by ALCO may be briefly unavailable while the updates are applied and services restart. ALCO's own service management systems, myALCO and ALCO websites will also be updated during this window and may be temporarily unavailable.
Administrators of affected sites have already been notified through the appropriate channels. You do not need to take any action.
Why this cannot wait
On October 21, 2026 the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. They can let an attacker run code on a web server without logging in, in some setups before a website's own code even runs. They are among the most serious PHP vulnerabilities in years.
The NSA has advised that these updates are a must, and national cybersecurity agencies in the United States, the United Kingdom and Europe have urged organizations to update immediately. The PHP project itself says there are no complete mitigations and that updating is the only safe choice. The Dutch National Cyber Security Centre expects large-scale exploitation soon.
Every site ALCO hosts already sits behind Cloudflare Enterprise, whose firewall began blocking known attack attempts on October 21. A firewall reduces the risk, but it is not a substitute for the fix, which is why we are applying the updates now rather than at a quieter time.
What we are doing
PHP is being updated to the patched releases, including PHP 8.3.36 and 8.2.35, through EasyApache 4.
cPanel is being updated to the patched release.
Services are restarted so the patched versions are actually running, then every hosted site is checked.
What you might notice
Short interruptions, usually a few minutes per site, between 6:00 PM Mountain Time and the end of the maintenance window tonight. If your site or application is not back to normal by tomorrow morning, call the help desk at (208) 391-7176 or open a request in myALCO.
Official advisories
The PHP project's security advisory for October 21, 2026 is here: https://www.php.net/archive/2026.php#2026-10-21-5
The Dutch National Cyber Security Centre advisory is here: https://github.com/NCSC-NL/php2shell
You can share this notice with your team or clients: https://alcohq.com/insights/notice-of-hosting-downtime-php-security-updates
Thank you for your patience while we keep your sites safe.
ALCO USA Inc.
Update — October 21, 2026
All ALCO-hosted sites have been patched. The PHP security updates are complete, all services are online, and no downtime was observed. No action is required from clients.