[Resolved] Web Hosting Outage Until Critical PHP Security Updates are Available
2026-10-21 11:15 PM ET – Plesk has provided updates that patch the vulnerable PHP versions. Those updates have now been installed. Hosted websites and services that use PHP are once again available.
2026-10-21 2:00 AM ET – On October 20, 2026, details of two critical remote code execution (RCE) vulnerabilities in PHP, leaked online before their coordinated disclosure and before patches were released. These vulnerabilities are identified by CVE-2026-109618 and CVE-2026-109619. Emergency patches, to the PHP software, are forthcoming.
A Remote Code Execution (RCE) vulnerability means that an attacker can take over an affected server.
PHP is used by many websites, and is required for websites that run WordPress and similar content management systems (CMS).
These vulnerabilities affect Widomaker’s Plesk server that provides website hosting to customers, as well as Widomaker’s own websites and weblog. Additionally, many website contact forms, including Widomaker’s own website contact forms, are PHP based and will be affected.
Due to the extreme severity of this vulnerability, and in order to avoid a full server compromise/breach, we plan to follow the advice of experts and isolate PHP, and the hosted websites that use it, from the Internet. This means that many of the websites we are hosting will go down until the PHP foundation and Plesk provide the necessary updates that will again allow running PHP, publicly on the Internet, safely. This could take several days. Some of Widomaker’s own websites will be affected.
Widomaker’s online ticketing system uses PHP, so that may not be available until updates are made available to us.
Furthermore, older versions of PHP (prior to version 8.2), that are no longer supported by the PHP foundation, may not receive a patch or update to fix the vulnerability. In that case, those web hosting customers who are using older unsupported versions may need to update their websites to use a supported version of PHP before their websites can go online again.
We apologize for the interruption in web hosting service, however, this critical vulnerability requires that we take these steps to protect our server and our customers’ data.
Updates, when available, may be found on our website (on an as available basis), our Facebook page, and our Status Page.
During this time, please try to avoid contacting us unless it is absolutely necessary and urgent, as we will be focusing our limited resources on following the progress of available updates and patches, and installing them once available. If you do need to reach us, email us using our helpdesk address found on our contact page.
[Completed] Email Maintenance Notice: Monday, September 28, 2026 @ 6:00 PM EDT
We have been notified that our email server provider will be performing maintenance during a 4-hour window scheduled for Monday, September 28, 2026, beginning at 6:00 PM EDT.
Email services (POP, IMAP, Webmail) will be unavailable between 6:15 PM and 8:15 PM EDT on Monday, September 28, 2026.
Email services will be intermittent for the remainder of the time. This may be experienced as failed login attempts, slow response times, and other unexpected behavior.
Please follow our email server provider’s status page for progress updates and additional information.
This scheduled maintenance will affect customers who have an @widomaker.com (or @tni.net) email address. Additionally, some business customers using Widomaker’s “Enhanced Email” service, with their own domain name, will also be affected. Customers whose email is hosted on our Plesk servers will NOT be affected.
Thank you for your patience while our provider performs maintenance aimed at improving the security, stability, and resiliency of their platform.
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code on WordPress Websites
Websites that use the WordPress content management systems (CMS) should update immediately.WordPress 6.9.5 and 7.0.2 patch wp2shell, a pre-auth core RCE that lets anonymous attackers run code on default installs, even with no plugins.
Source: New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
[Completed] Plesk Server Maintenance beginning, Sunday, July 12, 2026, 3:30 AM EDT
July 11 – Due to the recently discovered Januscape security vulnerability (CVE-2026-53359), our server provider will perform maintenance on the hosted environment that provides our Plesk server. Patching for this vulnerability will require a temporary shutdown of our server. The maintenance is scheduled to occur during a 9 hour window beginning at 3:30 AM EDT, early Sunday morning, on July 12, 2026. Our server provider estimates that downtime should be less than an hour, during that window. This downtime will affect customers that use their own custom domain names and have their websites and/or email hosted on our Plesk hosting server.
Since this blog will also be affected, should the need arise and this blog is unavailable, additional updates may be posted on Widomaker’s Facebook page (https://www.facebook.com/widomakercom) or on Widomaker’s Status Page (https://status.widomaker.com/).
July 12 – Maintenance has been completed.
THE BORING INTERNET by Terry Godier
The internet you grew up on isn’t dying.
Today, I ran across an excellent essay titled, The Boring Internet. I think anyone who longs for the Internet of the past would appreciate this relatively short read…
[Resolved] Email Login Issues on Saturday, April 4, 2026
On Saturday, April 4, 2026, we were notified, by our email server provider, that they were experiencing technical issues that affected customers’ ability to login, to check or send email (via Webmail, IMAP, or POP3). These issues may have affected customers who have an @widomaker.com (or @tni.net) email address. Additionally, some business customers using Widomaker’s “Enhanced Email” service, with their own domain name, may have been affected. Customers whose email is hosted on our Plesk servers were NOT affected. Affected customers may have been intermittently unable to log-on, to check or send email, for much of Saturday afternoon. The issues were resolved by Saturday evening. More details, updates, and potentially a future post-incident review, may be found at the below link to the status page of our email server provider…
[Resolved] Email Issue with SSL/TLS Connections (2/26/2026)
2/26/2026, 11:15 AM – Our email server provider is investigating an email issue related to SSL/TLS connections. This issue may affect @widomaker.com email addresses, and other customers using our Enhanced Email service with their own domain names.
Updates and details may be found at the link below…
2/26/2026, 1:50 PM – Engineering has issued a fix and services have returned to normal. This incident is resolved.
Winter Storm Fern Tips
With winter storm Fern approaching, I wanted to wish everyone a safe weekend and provide several links to winter storm and cold weather tips…
Easily Unsubscribe from Email Newsletters and Subscriptions
Are you suffering from email overload due to too many email subscriptions and newsletters? The third-party service Leave Me Alone can help you declutter your inbox. It scans your email to identify subscriptions and allows you to easily unsubscribe from unwanted mailing lists en masse. If you have many subscriptions or newsletters, this service makes it much easier to unsubscribe, instead of having to locate and click the unsubscribe link in each individual email message.
Several Widomaker customers have successfully used this service to clean up their Widomaker mailbox. It worked so well, we wanted to let our other customers know about it. Widomaker has no connection to this service other than being impressed with how well it worked.
Upcoming Holiday Hours – Nov. and Dec. 2025
Please find our upcoming holiday hours, through the end of 2025, below…
Support the EFF!
