Minor incident

SiteHost: Patching NodeJS against Node2Shell (CVE-2026-111497)

Affected: NZ – AKL01, NZ – AKL01, NZ – AKL01, NZ – AKL01, NZ – AKL02, NZ – AKL02, NZ – AKL02, NZ – AKL02, NZ – AKL03, NZ – AKL03, NZ – AKL03, NZ – AKL03, AU – SYD01, AU – SYD01, AU – SYD01, US – CAL01, UK – LDN01, US - CAL01, SG – SGP01, DE - FRA01, AU – SYD01, DE - FRA01

Current status of SiteHost: Operational — live SiteHost status

Timeline

1. Oct 26, 2026, 21:21 UTC
   identified
   Node2Shell (CVE-2026-111497) is a high-severity vulnerability. Current versions affected are 22.x, 24.x, and 26.x. Patched Cloud Container images are available and we recommend upgrading as soon as possible. Otherwise we will roll upgrades for all affected Cloud Containers (managed or unmanaged) today. This will happen alongside the latest round of PHP patching. Following this work we will move on to patching managed servers (virtual and dedicated). If you run unmanaged servers, please run your own updates as soon as you can.
2. Oct 26, 2026, 21:28 UTC
   identified
   We are continuing to work on a fix for this issue.
3. Oct 26, 2026, 23:34 UTC
   identified
   We are continuing to work on a fix for this issue.
4. Oct 26, 2026, 23:39 UTC
   identified
   We are upgrading NodeJS images for managed and unmanaged Cloud Containers running version 22, 24, or 26. Other versions are out of support and will not be patched. If you have any custom images that are based on one of our NodeJS images, we recommend that you update the base image, rebuild, then test and update the custom image as soon as you can.
5. Oct 27, 2026, 00:57 UTC
   resolved
   Patching is complete and this incident has been resolved.

Updates as published by SiteHost (original).