Security advisory: Node2Shell / HTTP2Shell (CVE-2026-111497)
Identified - A critical vulnerability (CVE-2026-111497) has been disclosed in the Brotli compression library used by Node.js and a number of other software platforms. Under certain conditions, an attacker could use specially crafted data to crash an affected application or potentially run code on the server. At the time of writing, no exploitation in the wild has been publicly reported.

What IronTree is doing

We have patched or are patching the IronTree-managed platforms that are affected.
We have scanned hosted servers for affected components and will contact clients whose servers show signs of them.
We are adding network-level protections where we can.

What our scans can and cannot tell you
Our scans can show that Node.js or related components are present on a server. They cannot tell us whether your specific application is actually exposed. That depends on how the software vendor built and configured the application. Many applications include their own copy of Node.js, which our scans may not fully detect.

What we recommend

Contact your software vendor to confirm whether your application is affected and when a fix will be available.
Apply vendor updates as soon as they are released. Fixed Node.js versions are 22.23.4, 24.22.1 and 26.12.1 or later.
Don’t replace a runtime bundled inside a vendor application yourself. Wait for the vendor’s update.

If you have questions or would like help coordinating with your vendor, please contact IronTree Support.
Oct 26, 2026 - 16:01 CAT
PHP Vulnerabilities
Identified - On 21 October 2026 the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (“php2shell”). They affect PHP installations that serve web requests, going back to PHP 5.4. Exploitation attempts have been reported in the wild.

IronTree platforms: patching and mitigation of affected IronTree systems is in progress. Status updates for specific services will be posted separately.

Client-hosted systems: clients are responsible for patching PHP and the applications that run on it. Please update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution’s patched package), restart PHP services, and upgrade any end-of-life PHP versions as soon as possible. IronTree is identifying vulnerable client systems and will contact affected clients directly.

We encourage you to review you applications for the affected PHP version and should you suspect your applications are vulnerable, you should patch as soon as possible.

If you’d like extra snapshots or backups taken before patching, contact support by emailing vps@irontree.co.za
Oct 22, 2026 - 13:31 CAT
IronTree Platform Migrations
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 12, 2026 - 20:00 CAT
Scheduled - We will performing migrations for all VMWare hosted clients between 20:00-00:00 every night until our platforms have been migrated. This is an ongoing migration, it will include all clients systems.

All Migrations need to be completed before 2027.

Please see communication sent out below:
https://everfiles.metrofilecloud.com/public-link/browse/viNBiHtYXz

If you would like to schedule your migration, please contact vps@irontree.co.za
Oct 12, 2026 20:00 - Oct 13, 2026 00:00 CAT
Uptime over the past 90 days. View historical uptime.
Hosting Services Operational
IronTree VPC Hosting Operational
IronTree VPS Hosting Operational
Backup and Protect Operational
IronTree Backup Web Console Operational
IronTree Backup Storage Operational
Disaster Recovery Operational
IronTree Disaster Recovery Web Console Operational
IronTree Disaster Recovery Storage Operational
IronTree Cloud Vault Object Storage Operational
IronTree EverFiles Operational
Internet Connectivity Operational
Internet Connectivity (BGP 1) Operational
Internet Connectivity (BGP 2) Operational
Internet Connectivity (DIA) Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.

No incidents or maintenance related to this downtime.

Oct 31, 2026

No incidents reported today.

Oct 30, 2026

Scheduled maintenance – virtual machine restarts, 29 October 2026, 20:00–00:00 SAST
Completed - The scheduled maintenance has been completed.
Oct 30, 00:00 CAT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 29, 20:00 CAT
Scheduled - We will be carrying out maintenance on our virtual infrastructure platform tonight to complete a processor compatibility update.

Window: Thursday, 29 October 2026, 20:00–00:00 (SAST)

Impact: Selected client virtual machines will be shut down and started again from the platform. Each affected virtual machine may be unavailable for up to 15 minutes at some point during the window. Virtual machines that are currently powered off are not affected.

No action is required from clients. If you have any questions, please contact our support team at vps@irontree.co.za.

Updates will be posted here as the maintenance progresses. We apologise for the short notice and any inconvenience.
Oct 29, 14:38 CAT

Oct 29, 2026

Unresolved incident: Security advisory: Node2Shell / HTTP2Shell (CVE-2026-111497).

Oct 28, 2026

Virtual machine service interruption – 28–29 October 2026
Resolved - On the evening of 28 October 2026, a processor compatibility update was applied to our virtual infrastructure platform to support new compute hosts. After the change, our automated workload-balancing service attempted to move some virtual machines between hosts. These moves could not complete, and a small number of client virtual machines were placed in an error state between 20:22 on 28 October and 04:22 on 29 October 2026 (SAST). Services on the affected virtual machines were unavailable from that point.

The issue was identified on the morning of 29 October 2026. From 08:42, our engineers shut down, migrated and restarted each affected virtual machine, and all were restored and verified. No data was lost.

To complete the update, the remaining virtual machines will be restarted during scheduled maintenance tonight, 29 October 2026, from 20:00 to 00:00 (SAST): https://status.irontree.co.za/incidents/3t8z99r97d8s

We are reviewing our change process to include automated platform services in impact assessments. We apologise for the disruption. If you have any questions, please contact our support team at vps@irontree.co.za.
Oct 28, 20:00 CAT

Oct 27, 2026

No incidents reported.

Oct 26, 2026

Remote Desktop Connection Issues
Resolved - Microsoft has released an update that resolves the Remote Desktop (RDP) connection issues caused by a previous Windows update. Once the latest updates are installed, affected systems should connect normally. We are now closing this incident. If you still experience RDP connection issues after installing the latest updates, please contact our support team.
Oct 26, 15:54 CAT
Identified - We are aware of issues with RDP Sessions dropping and new connections not establishing. This is due Microsoft's September Cumulative Updates. Should you experience any issues with your Remote Desktop Connections, please reach out to our Support Team or log a request by emailing vps@irontree.co.za For a full breakdown of the root cause and solution, please reference the following article: https://www.bleepingcomputer.com/news/microsoft/september-windows-server-updates-break-remote-desktop-services/
Sep 11, 10:13 CAT

Oct 25, 2026

No incidents reported.

Oct 24, 2026

No incidents reported.

Oct 23, 2026

No incidents reported.

Oct 22, 2026

Unresolved incident: PHP Vulnerabilities.

Oct 21, 2026

No incidents reported.

Oct 20, 2026

No incidents reported.

Oct 19, 2026

No incidents reported.

Oct 18, 2026

No incidents reported.

Oct 17, 2026

No incidents reported.

Incident History Powered by Atlassian Statuspage