Cloud Linux Inc.

Home
United States
Palo Alto, CA
Cloud Linux Inc.

Linux Operating System for Service Providers

10/30/2026

"Sometimes some plugin becomes vulnerable, and you have to prioritize and suddenly update 300 websites. I would hate that to happen."

That's Alex Merenkov, director of I Need Website, on the part of agency hosting that never stays quiet for long.

His agency looks after about 500 client sites on five servers, with three people. A disclosed plugin flaw used to mean dropping everything and updating every affected site at once.

Now the web application firewall (WAF) in Imunify360 blocks known exploits against vulnerable plugins, themes, and WordPress core in the meantime. Updates become a monthly round instead of an emergency.

"I know there's a vulnerability, I have to update this plugin, but I can do it at my pace."

How a three-person agency keeps client sites protected without living in the update queue:
https://hubs.ly/Q04CV6bf0

10/30/2026

Some tricks only work if you’re slow to patch, still running EOL software, or reusing passwords.

Don’t let them get the last laugh this Halloween. 🎃

KernelCare keeps you safe, like a treat!

https://hubs.ly/Q04BK87N0

10/29/2026

We're heading back to Miami 🌴😎

CloudLinux is a Gold partner at Americas this November.

Two days and over 2,000 people! It’s the place to be for anyone in the hosting, cloud, and domain space.

We can't wait to catch up with all our partners and friends! If you haven’t purchased your ticket yet, use our code CLOUDLINUX20 for 20% off.

Find us at booth 204.

10/29/2026

56% of hosting providers say competing on price with unmanaged cloud is their top VPS challenge (Web Hosting Trends Report 2026).

Five providers on the CloudLinux VPS Bundle are answering it differently. Their managed VPS plans run CloudLinux and Imunify360, and this is what they say changed:

→ https://hubs.ly/Q04B5Qtc0: scaling faster without sacrificing quality or margins.
→ https://hubs.ly/Q04B5Q870: faster, more stable, more secure VPS plans, with lower support costs.
→ DominiOK: less support overhead and more stable, secure VPS services.
→ CodeforHost: server management that is easier, faster, and cost-efficient.
→ Pamir Web Host: over 50% saved while improving client offerings.

The common thread isn’t a feature. It’s where the support team’s time goes: optimization and growth instead of firefighting.

If this sounds like your fleet, happy to compare notes. You can also explore the CloudLinux features for free: https://hubs.ly/Q04B5Q880

10/29/2026

Missed our session on WordPress security for hosting providers? The recording is up.

In 45 minutes we covered:

- Why WordPress sites stay exposed for weeks after a fix ships, and what covers them in the meantime
- How a self-healing malware campaign survived cleanup, all the way to the browser
- The protection layers it took to stop it
- How to run them on your servers, including the free 14-day Imunify360 trial

Watch on demand: https://hubs.ly/Q04CL2XJ0

10/28/2026

PHP’s fix for last week’s critical flaws covered four versions: 8.2 to 8.5.

Hosting servers run on 16.

Customer sites run whichever PHP version their application needs. A host can’t force an upgrade without breaking those sites, so “run a supported version” doesn’t help them much on a Tuesday night.

So we built fixes for the other branches ourselves. That’s all 16 we maintain, PHP 5.2 through 8.5:

- Imunify360’s firewall was blocking the public exploit 4.5 hours before PHP’s own fix shipped
- Fixed cPanel ea-php builds went out about seven hours after PHP’s release
- Fixed alt-php, the versions behind PHP Selector, reached CloudLinux stable about 10 hours after

We’ve written up the hour-by-hour timeline, and the question it leaves for every host: when PHP stops patching a version your customers still run, who does?

PHP 8.2 reaches end of life on 31 December.

https://hubs.ly/Q04CyXbl0

10/28/2026

Buenos dias, Barcelona 👋

PressConf EU starts today, and the CloudLinux team is here at H10 Marina.

Ryan Bradbury, Georgi Dimitrov, Sergey Gruntovsky, and Svilena Peneva are around until 30 October. There's no booth, so look for us between sessions and over coffee, and come say hi.

Want to set up a proper chat?

Book a slot here: https://hubs.ly/Q04CyMRb0

10/23/2026

One shell account on a shared server can be enough to reach root through a new Linux kernel flaw, wherever unprivileged user namespaces are open.

It sits in the kernel networking stack and is the same class as Dirty Pipe. A local user changes files they can only read, then climbs to root.

Who is affected: servers running an affected kernel where ordinary accounts can create user namespaces. CloudLinux 7 is not affected, and CloudLinux 10 and Ubuntu 22.04 ship with namespaces closed. On shared hosting, root reaches every tenant’s files, databases, mail, and credentials.

In our test, CageFS did not contain it: a compiled test program succeeded inside the cage.

Where it stands on 23 October: public exploit code exists, CloudLinux is not aware of any report of use in the wild, and it cannot be reached from the outside network. The upstream repair was posted for review yesterday and is not merged. There is no fixed kernel and no livepatch yet.

What to do today: run sysctl user.max_user_namespaces. A value of 0 closes the path without a reboot. The cost is that rootless Podman and Docker, unprivileged LXC, Flatpak, and some browser sandboxes stop working for ordinary accounts.

Affected versions and the full mitigation are in the advisory: https://hubs.ly/Q04Cb1sk0

If you check your fleet, tell me what you find, especially if you can’t set it to 0.

10/23/2026

“We've run it for years without an incident."

It sounds like a good reason to leave end-of-life software alone. It also gets wrong where that clean record came from.

Take MariaDB 10.6. In its five supported years, the project shipped 79 security fixes across 17 releases. The last one, in May 2026, fixed a vulnerability with a CVSS score of 10.0, the highest possible, just 40 days before end of life.

The software wasn't unusually sturdy. Someone was patching it.

When a version hits end of life, that someone stops patching it, but the software keeps running on your servers. On a shared server, one unsupported component puts every customer site that depends on it at risk.

Here’s how to check your status:

List the major components on your servers:

❗ OS
❗ Database
❗ PHP
❗ Web server
❗ OpenSSL/OpenSSH

Write down each one's end-of-life date.

For anything already past that date, or less than 12 months away, decide now: upgrade on a planned schedule, or keep it patched until you're ready.

That second option is what Endless Lifecycle Support (ELS) does. Security fixes are applied to the same version you already run and arrive through yum, dnf, or apt, so you don't have to migrate.

Check out how to stay safe while planning a proper migration: https://hubs.ly/Q04BJvJ30

Which end-of-life date is on your calendar right now?

Tell us in the comments.

10/22/2026

Most VPS pricing sheets have a blind spot: the support hours.

A hacked-site ticket on a VPS is rarely just one ticket. It’s triage, cleanup, back-and-forth with the customer, and a follow-up when it happens again.

So when you price a VPS bundle, the license line is only half the picture. Margin is what you charge, minus what you pay for licenses, minus what you spend serving the customer after the sale.

That last number is the one most spreadsheets leave out.

It can be big. Two numbers from providers running Imunify360:

➡️ HostArmada reported a 70-80% drop in hacked-website support tickets on VPS.
➡️ Esmero reported support workload down by about an hour a day.

Try this today:

1. Count last month’s hacked-site tickets.
2. Multiply by the average hours each one took, including repeat visits.
3. Multiply by your loaded hourly support cost.

That total is a real line item on every VPS you sell. Add it to your margin math.

See how the VPS program is built to take that cost down:

Learn more: https://hubs.ly/Q04BJkjw0

Address

2318 Louis Road, Suite B
Palo Alto, CA
94303

Website

http://www.cloudlinux.com/

Alerts

Be the first to know and let us send you an email when Cloud Linux Inc. posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.