Month: October 2026

We’re busy with mitigations and emergency upgrades to resolve yet another high severity security problem, this time, it’s TCP handling in the Linux kernel.  This originally wasn’t believed to be as severe as a problem but at least one security researcher has been able to find a remote exploit path using MPTCP and while none of our system provide or us MPTCP, we’re treating this as a critical problem and have begun rolling out kernels to all affected systems and performing mid day reboots.  While the majority of our public facing services are redundant and high availability you may notice brief intermittent issues reaching some services, including email, while these reboots are underway.  For more information, see https://nvd.nist.gov/vuln/detail/cve-2026-98432

-Kelsey and the entire System Operations Team.

Out of an abundance of caution we are selectively shutting down all of our public web sites in response to a severe PHP RCE that was going to be disclosed tomorrow morning.  Unfortunately, it looks like there are already functional proof-of-concept exploits for the two problems in the wild.  This includes webmail, forums, membertools, sonic.com, as well as ancillary other services, including sonicstatus.com.  We will work on restoring all of these services as quickly as possible once this fixes become available tomorrow or we are confident that we’re able to use local mitigations to close the exploit paths.

For more information, see https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/

-Kelsey, and the rest of the Sonic System Department

Update Wed Oct 21 09:46:46 PDT 2026: PHP released their fixed versions this morning and we’ve been working on rolling out the updates as quickly as possible to restore all affected services. We expect that all disabled systems except for members.sonic.net to be back online in the next hour. -Kelsey

Update Wed Oct 21 10:42:42 PDT 2026: All disabled systems except for members.sonic.net are back online, members.sonic.net relies on a version of php which has not been patched yet.  -Kelsey

Update Wed Oct 21 12:15:02 PDT 2026: All disabled systems except for members.sonic.net are back online for real this time, webmail had been fixed but the static maintenance page was accidentally left in place.  -Kelsey

Update Wed Oct 21 18:12:02 PDT 2026:  members.sonic.net has been returned to service and all remediation work for external resources has been completed.  -Kelsey, and the rest of the Systems and Programming.