Web Hosting Security Update: PHP and Node.js Response Timeline

Louisville Geek actively monitors and maintains the web hosting servers that support the websites we host for our customers. When new security vulnerabilities are disclosed, our team evaluates the potential impact, applies appropriate protections and security updates, and verifies the affected systems.

In response to the recent PHP security vulnerabilities, our team worked throughout October 21 to apply protections, deploy updates as they became available, and verify our web hosting environment. The timeline below provides a detailed account of our response.

All times are Eastern.

October 21, around 2:00 a.m.

We became aware of overnight posts circulating alleged PHP exploit details ahead of the scheduled patch release. We began our response around 2:30 a.m.

October 21, by 3:54 a.m.

Interim PHP mitigations were applied and verified on the Louisville Geek Managed Servers.

October 21, around 10:00–11:04 a.m.

Following the official PHP security release, we patched the available cPanel-provided PHP packages and verified the affected sites. This phase completed around 11:04 a.m. on the Louisville Geek Managed Servers.

October 21, throughout the day

We followed up with further downstream fixes from our vendors.

October 21, by 4:38 p.m.

The applicable vendor-provided PHP security packages were installed and verified on both managed nodes.

October 21, by 7:00 p.m.

Patching and verification were complete for the legacy website PHP packages covered by the rollout, including the additional PHP 5.6 update.

October 21, by 11:06 p.m.

Both managed nodes’ older Node.js installations were migrated to patched Node.js 22.23.4. Final verification finished around 11:16 p.m.