Patching is complete and this incident has been resolved.
Posted Oct 27, 2026 - 13:57 NZDT
Update
We are upgrading NodeJS images for managed and unmanaged Cloud Containers running version 22, 24, or 26. Other versions are out of support and will not be patched.
If you have any custom images that are based on one of our NodeJS images, we recommend that you update the base image, rebuild, then test and update the custom image as soon as you can.
Posted Oct 27, 2026 - 12:39 NZDT
Update
We are continuing to work on a fix for this issue.
Posted Oct 27, 2026 - 12:34 NZDT
Update
We are continuing to work on a fix for this issue.
Posted Oct 27, 2026 - 10:28 NZDT
Identified
Node2Shell (CVE-2026-111497) is a high-severity vulnerability. Current versions affected are 22.x, 24.x, and 26.x. Patched Cloud Container images are available and we recommend upgrading as soon as possible. Otherwise we will roll upgrades for all affected Cloud Containers (managed or unmanaged) today. This will happen alongside the latest round of PHP patching.
Following this work we will move on to patching managed servers (virtual and dedicated). If you run unmanaged servers, please run your own updates as soon as you can.
Posted Oct 27, 2026 - 10:21 NZDT
This incident affected: Windows Virtual Servers (NZ – AKL01, NZ – AKL02, NZ – AKL03, AU – SYD01), Dedicated Servers (NZ – AKL01, NZ – AKL02, NZ – AKL03, AU – SYD01), Cloud Containers (NZ – AKL01, NZ – AKL02, NZ – AKL03, US – CAL01, UK – LDN01, SG – SGP01, AU – SYD01, DE - FRA01), and Linux Virtual Servers (NZ – AKL01, NZ – AKL02, NZ – AKL03, AU – SYD01, US - CAL01, DE - FRA01).