{"id":11030,"date":"2026-11-09T20:49:56","date_gmt":"2026-11-09T20:49:56","guid":{"rendered":"https:\/\/www.hostinger.com\/blog\/?p=11030"},"modified":"2026-11-10T16:31:18","modified_gmt":"2026-11-10T16:31:18","slug":"phoenix-server-incident-2026","status":"publish","type":"post","link":"https:\/\/www.hostinger.com\/blog\/phoenix-server-incident-2026\/","title":{"rendered":"Unauthorized access to our Phoenix server: November 2026 incident report\u00a0"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><b>Updated November 10, 16:03 UTC<\/b><span style=\"font-weight: 400\">: LiteSpeed released the fix in LiteSpeed Web Server 6.3.7 Build 9, and it&rsquo;s now installed on all our shared hosting servers. We&rsquo;ve updated this post accordingly.<\/span><\/p><p><span style=\"font-weight: 400\">On November 9, 2026, we detected unauthorized access to one of our shared hosting servers in Phoenix, United States. The attacker exploited a previously unknown (zero-day) vulnerability in one of our vendors, LiteSpeed Web Server. We mitigated the issue on our shared hosting servers and worked with LiteSpeed to develop a permanent fix, which is now installed on all our shared hosting servers.&nbsp;<\/span><\/p><p><span style=\"font-weight: 400\">Below, we explain what happened and how we responded.<\/span><\/p><p><b>In short:<\/b><\/p><ul>\r\n<li style=\"font-weight: 400\"><b>What happened<\/b><span style=\"font-weight: 400\">: an attacker exploited a vulnerability in a customer&rsquo;s website to get onto the server website was hosted, then used another previously unknown vulnerability in LiteSpeed Web Server, the software we use to serve websites, to break out of that website&rsquo;s isolated environment.<\/span><\/li>\r\n<li style=\"font-weight: 400\"><b>Who is affected<\/b><span style=\"font-weight: 400\">: customers on one of the more than 5,000 servers we operate. The attacker ran code or read credentials on about 400 accounts.<\/span><\/li>\r\n<li style=\"font-weight: 400\"><b>What we did<\/b><span style=\"font-weight: 400\">: moved every account and website to other servers, restored affected websites from backups taken before the attack, and closed each path the attacker used. On November 10, when LiteSpeed released a fix, we deployed it on all our shared hosting servers.<\/span><\/li>\r\n<\/ul><h2 id=\"h-what-happened\"><span style=\"font-weight: 400\">What happened<\/span><\/h2><p><span style=\"font-weight: 400\">On November 8, our security team&rsquo;s monitoring tool flagged suspicious activity on the server. The investigation found that an attacker had first entered on November 5 through a vulnerable content management system on a customer website.<\/span><\/p><p><span style=\"font-weight: 400\">From there, it took three days for the attacker to find and exploit a new vulnerability in LiteSpeed Web Server. It allowed code from one website to bypass the isolation between accounts provided by <\/span><i><span style=\"font-weight: 400\">CloudLinux CageFS<\/span><\/i><span style=\"font-weight: 400\">, eventually leading to root-level access on the server.<\/span><\/p><p><span style=\"font-weight: 400\">The attacker ran code or read credentials on about 400 accounts, including database credentials and access tokens. We found no evidence that the attacker compromised our internal management systems, our backup system, or the systems that handle logins to Hostinger accounts, and no evidence that any backups were decrypted.<\/span><\/p><h2 id=\"h-what-we-did\"><span style=\"font-weight: 400\">What we did<\/span><\/h2><p><span style=\"font-weight: 400\">Because the attacker&rsquo;s code ran as the shared web server user, their activity blended in with normal server traffic until our security monitoring systems identified it. We declared an incident at 12:26 UTC on November 9. We removed the attacker&rsquo;s access, rotated internal credentials, and preserved evidence for forensic analysis. From 13:30 UTC, we moved accounts to other servers and restored affected websites from backups taken before the attack. The original server is offline and held for investigation.<\/span><\/p><p><span style=\"font-weight: 400\">We emailed affected customers individually and notified the competent authority about the incident.<\/span><\/p><p><span style=\"font-weight: 400\">In parallel, we worked directly with LiteSpeed to fix the vulnerability. On November 10, LiteSpeed released the fix in 6.3.7 Build 9, and by 16:03 UTC, it was installed on all our shared hosting servers.<\/span><\/p><h2 id=\"h-whats-next\"><span style=\"font-weight: 400\">What&rsquo;s next<\/span><\/h2><p><span style=\"font-weight: 400\">The configuration changes we made during the response stay in place as an extra layer of protection. Our investigation is ongoing, and we&rsquo;ll update this post with any new findings.<\/span><\/p><p><span style=\"font-weight: 400\">If you have questions, our Customer Success team is available 24\/7 through the Hostinger dashboard, and you can report security concerns to security@hostinger.com.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Updated November 10, 16:03 UTC: LiteSpeed released the fix in LiteSpeed Web Server 6.3.7 Build 9, and it\u2019s now installed on all our shared hosting servers. We\u2019ve updated this pos\u2026<\/p>\n","protected":false},"author":495,"featured_media":11032,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_content_updated_date":"","footnotes":""},"categories":[82],"tags":[],"hashtags":[],"class_list":["post-11030","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-engineering"],"hreflangs":[],"_links":{"self":[{"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/posts\/11030","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/users\/495"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/comments?post=11030"}],"version-history":[{"count":4,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/posts\/11030\/revisions"}],"predecessor-version":[{"id":11057,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/posts\/11030\/revisions\/11057"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/media\/11032"}],"wp:attachment":[{"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/media?parent=11030"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/categories?post=11030"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/tags?post=11030"},{"taxonomy":"hashtags","embeddable":true,"href":"https:\/\/www.hostinger.com\/blog\/wp-json\/wp\/v2\/hashtags?post=11030"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}