Protect the Backups You’re Counting On

October has given hosting teams plenty to deal with. Emergency PHP patches. Node.js security releases. Compromised WordPress connections and plugin downloads. Incidents involving the services businesses depend on to protect their data.

For hosting providers, agencies, and server administrators, that means another round of updates, customer questions, and checks across the fleet.

It also raises a practical question: if something happens to your production environment, will your backups still be there – and can you restore them?

Here’s what deserves your attention, and what we’ve been working on at JetBackup to help protect your ability to recover.

PHP2Shell puts PHP updates at the top of the list

PHP released fixes for CVE-2026-109618 and CVE-2026-109619 on October 21. Known as PHP2Shell, these vulnerabilities prompted emergency updates in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Check the PHP security announcements for affected configurations and mitigation guidance.

For hosts running several PHP versions, checking one installation won’t cover the server. Review every version serving customer websites, including packages supplied through your control panel or operating system vendor. Confirm the running web processes have picked up the patched builds.

PHP also announced CVE-2026-115560, a separate issue involving an unusual combination of session settings. The October 21 releases do not fix it. PHP recommends disabling session upload progress for affected configurations while it prepares a regular release fix.

Keep that distinction clear when communicating with customers. Installing the emergency patches addresses the disclosed PHP2Shell vulnerabilities; it doesn’t close every subsequent PHP advisory.

Node.js needs attention, too

While PHP dominated the conversation, Node.js released security updates across its supported 22.x, 24.x, and 26.x lines.

The October 21 releases 2.23.4, 24.22.1, and 26.12.1 address issues involving DNS resolution, TLS, Brotli, and bundled dependencies. The highest severity is High. Details are in the Node.js security release announcement.

Check application servers, container images, and Node.js installations managed through panel extensions. An updated host can still be running applications inside an older image.

Your control panel belongs on the patch list

Hosting infrastructure gives administrators powerful tools. Vulnerabilities in those tools can put multiple customer accounts at risk.

October’s disclosures included CVE-2026-93699 in cPanel’s WP Toolkit, which allows local users to execute code as other accounts on the same server. Version 6.11.4 addresses the issue. See the vulnerability record and vendor reference.

HestiaCP and SolusVM administrators should also review their vendors’ current security guidance and installed builds. The HestiaCP changelog and SolusVM advisory provide the relevant update details.

A panel update, plugin update, and PHP update may follow different schedules. Make sure your maintenance process covers each one.

WordPress incidents show how far trusted access can reach

The TeamUpdraft incident involved unauthorized access to its website and the suspected exposure of customer information, including service connection keys. TeamUpdraft confirmed that attackers abused connections to customer sites to create accounts and install malicious plugins.

The company released updates to revoke older UpdraftCentral connections and provided recovery instructions. It also stated that the UpdraftPlus plugin downloads themselves were unaffected.

That distinction matters. A legitimate remote management connection can become an attack path when its credentials are exposed. Revoking the connection helps close that path, but administrators still need to investigate what happened while it was available.

Rank Math reported a different problem: certain Rank Math PRO 3.0.123 downloads contained malware. The affected window ran from 20:02 UTC on October 15 to 07:12 UTC on October 16. The company released a clean version 3.0.124and published instructions for affected customers.

Backuply also released 1.5.9, including a security fix related to restoration. Its official changelog identifies the corrected release.

The practical takeaway is straightforward: check versions across every site you manage. Where a compromise occurred, follow the vendor’s cleanup guidance, review accounts and credentials, and verify that any backup used for recovery predates the compromise.

An update for JetBackup for WordPress

We also need to address our own software.

CVE-2026-104068 affects JetBackup for WordPress versions before 3.1.24.10. A crafted backup archive containing a symbolic link could allow an authenticated WordPress administrator to write files outside the intended restore destination.

The vulnerability requires administrator privileges, but it still crosses a boundary the restore process should enforce. The fix is available on 3.1.24.10. If you use JetBackup for WordPress, update affected installations. The published advisory record describes the issue.

Backup software carries significant responsibility. That includes correcting vulnerabilities and being clear about the action customers need to take.

Your recovery plan depends on your providers, too

Incidents involving backup and hosting services deserve attention because they can affect access to the tools needed during recovery.

ConnectWise reported unauthorized access involving application identities associated with Cloud Backup, formerly SkyKick, and disabled affected identities as part of its response. Customers should follow the company’s Trust Center guidance.

Google Threat Intelligence also published research in October describing tampering with AOMEI’s update infrastructure during a campaign investigated between April and July. Its research explains how brief changes to update configuration delivered malicious software.

GMO published notices concerning unauthorized access to Onamae.com Desktop Cloud. DreamHost’s status page has also reported disruptions affecting its File Manager and email services.

These events have different causes and consequences. They do share a planning consideration: your recovery process needs to account for a provider or management service becoming unavailable.

Document how you would retrieve a usable copy if your normal recovery route were interrupted.

Ransomware operators want your recovery options

The October 20 SafePay ransomware advisory reinforces the need to protect backup infrastructure alongside production systems.

A backup strategy needs separate credentials, deliberate permissions, sufficient retention, and copies that remain accessible during an incident.

Test those assumptions. Confirm who can delete your backups, which credentials control your destinations, and whether your team can complete a restore without depending on a compromised production account.

What we’ve been working on at JetBackup

These are the same concerns shaping our development work: protecting administrative access, preserving restore points, and making recovery dependable.

Stronger authentication

JetBackup 5.4.0 introduced API support for two-factor authentication, as documented in the release notes.

Backup administrators can change destinations, adjust retention, and initiate recovery. Those privileges deserve strong access controls.

Two-factor authentication adds protection against a stolen password becoming access to supported workflows. Pair it with carefully scoped permissions, credential rotation, and regular access reviews.

Protecting retained backups with Object Lock

JetBackup 5.4.2 introduces S3 Object Lock support and an Immutable Backups Wizard. These features help administrators configure protection against accidental deletion and ransomware. See the 5.4.2 release notes.

With a compatible destination and correctly configured retention, Object Lock can protect retained object versions against deletion or overwriting for a defined period.

Availability matters: the 5.4.2 series is on the Edge tier as of October 26. Check your installed version, update tier, destination support, and retention requirements before planning a deployment. The JetBackup changelog lists current builds.

More options for where your backups live

JetBackup Premium Cloud Storage combines decentralized storage architecture, encryption, self-healing technology, and S3 compatibility.

Storage durability is one part of recovery planning. Access controls, retention, and the ability to retrieve a usable copy still need deliberate configuration.

Consider which copies share credentials or administrative access. That helps identify where one compromised account could affect several destinations.

Keeping the recovery software current

Our work also includes dependency updates, internal security improvements, backup validation, and integrity-check scheduling.

For PHP2Shell specifically, the JetBackup changelog records the bundled PHP update in 5.4.1.5 and 5.4.2.5. Include JetBackup itself in your update checks.

Protect the restore you may need tomorrow

Our customers trust JetBackup with the copies they may need during a serious outage or compromise. That responsibility guides what we build and maintain.

For hosting companies, now is the time to have a clear conversation with customers about security. Explain what your standard hosting package includes, what those protections cover, and where customers have responsibilities of their own. Make your backup retention, recovery options, and restore process easy to understand.

Help customers take a more active role in protecting their businesses. Show them how to access and restore their backups through JetBackup, and explain how an additional backup destination or longer retention could support their recovery needs. Where you offer additional security services, connect each recommendation to a specific need, whether that is malware monitoring, application updates, or help responding to an incident.

These conversations can support your security upsells while giving customers useful information before they are under pressure. Be clear about what each service provides and what still requires their attention.

Many customers only start asking about security after a breach. This year’s incidents give hosting providers a reason to start that conversation earlier. Across the internet, widely used software, trusted vendors, and critical services have all faced compromise. Every business needs to plan for that possibility.

Start with your own environment: apply the updates, review backup access, confirm retention, and run a restore test. Then help your customers understand how those steps protect their websites, and what they can do to strengthen their own recovery plan.

The time to explain how recovery works is while everything is still running.