Investigating - A security vulnerability, CVE-2026-65640, has been identified in WordPress that could allow an authenticated Author-level or higher user to achieve remote code execution through a malicious file upload on sites using Imagick and Ghostscript.
The vulnerability has been addressed through updates across supported WordPress branches.
Patched Versions:
Customers should update to the following patched version for their respective WordPress branch:
7.0.4
6.9.7
6.8.8
6.7.7
6.6.7
6.5.10
6.4.10
6.3.10
6.2.11
6.1.12
6.0.14
5.9.16
5.8.15
5.7.17
5.6.19
5.5.20
5.4.21
5.3.23
5.2.26
5.1.24
5.0.27
4.9.31
4.8.30
4.7.35
Recommended Action:
Customers are strongly encouraged to update WordPress core to the latest available patched version and ensure automatic updates are enabled where appropriate.
Customers with automatic updates enabled should receive the applicable update automatically. However, we recommend verifying the currently running WordPress version to ensure the security update has been successfully applied.
We will continue to monitor the situation and provide further updates if required.
If you need assistance or have any concerns, please reach us via live chat or via a case.
Additional information:
https://wordpress.org/news/2026/08/wordpress-7-0-4-release/
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w
Aug 12, 2026 - 11:45 EDT
The vulnerability has been addressed through updates across supported WordPress branches.
Patched Versions:
Customers should update to the following patched version for their respective WordPress branch:
7.0.4
6.9.7
6.8.8
6.7.7
6.6.7
6.5.10
6.4.10
6.3.10
6.2.11
6.1.12
6.0.14
5.9.16
5.8.15
5.7.17
5.6.19
5.5.20
5.4.21
5.3.23
5.2.26
5.1.24
5.0.27
4.9.31
4.8.30
4.7.35
Recommended Action:
Customers are strongly encouraged to update WordPress core to the latest available patched version and ensure automatic updates are enabled where appropriate.
Customers with automatic updates enabled should receive the applicable update automatically. However, we recommend verifying the currently running WordPress version to ensure the security update has been successfully applied.
We will continue to monitor the situation and provide further updates if required.
If you need assistance or have any concerns, please reach us via live chat or via a case.
Additional information:
https://wordpress.org/news/2026/08/wordpress-7-0-4-release/
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-8vr3-7mxf-gx8w
Aug 12, 2026 - 11:45 EDT
Investigating - A high-severity reflected XSS vulnerability, CVE-2026-64638, has been identified in the WordPress login interface. Exploitation requires a victim to visit a specially crafted URL and, under specific conditions, could potentially lead to PHP code execution.
Impacted versions:
WordPress 4.7 – 7.0.2 (every release on every branch)
WordPress 4.6 and earlier — end of life, no patch available
Fixed versions:
WordPress 7.0.3
WordPress 6.9.6
WordPress 6.8.7
Equivalent minor releases on every remaining supported branch back to 4.7
Recommended Action
Customers are strongly encouraged to update WordPress core and ensure automatic security updates are enabled where appropriate. Since exploitation requires user interaction, customers should also remain vigilant against phishing attempts and avoid clicking suspicious or unsolicited links.
Customers with automatic security updates enabled should receive the applicable update automatically; however, we recommend verifying the currently running WordPress version.
There is currently no reported evidence of widespread exploitation in the wild. We will continue to monitor the situation and provide further updates if required.
If you need assistance or have any concerns, please contact our Support team.
Aug 08, 2026 - 09:28 EDT
Impacted versions:
WordPress 4.7 – 7.0.2 (every release on every branch)
WordPress 4.6 and earlier — end of life, no patch available
Fixed versions:
WordPress 7.0.3
WordPress 6.9.6
WordPress 6.8.7
Equivalent minor releases on every remaining supported branch back to 4.7
Recommended Action
Customers are strongly encouraged to update WordPress core and ensure automatic security updates are enabled where appropriate. Since exploitation requires user interaction, customers should also remain vigilant against phishing attempts and avoid clicking suspicious or unsolicited links.
Customers with automatic security updates enabled should receive the applicable update automatically; however, we recommend verifying the currently running WordPress version.
There is currently no reported evidence of widespread exploitation in the wild. We will continue to monitor the situation and provide further updates if required.
If you need assistance or have any concerns, please contact our Support team.
Aug 08, 2026 - 09:28 EDT
Support Services
Operational
Tickets
Operational
Phones
Operational
Chats
Operational
Help Center
Operational
Platform Operations
Operational
Web Services
Operational
DNS
Operational
SSH/FTP
Operational
Email
Operational
MySQL
Operational
InterWorx Control Panel
Operational
Cluster / NFS
Operational
Platform Updates / Other
Operational
Managed Wordpress
Operational
Wordpress Core Updates
Operational
Wordpress Plugin Updates via Visual Compare
Operational
Nexcess Cloud
Operational
us-midwest-1
Operational
us-west-1
Operational
uk-south-2
Operational
nl-west-1
Operational
au-south-1
Operational
us-midwest-2
Operational
Cloud Container Services
Operational
us-midwest-1
Operational
us-west-1
Operational
uk-south-2
Operational
nl-west-1
Operational
au-south-1
Operational
us-midwest-2
Operational
Nexcess Global DNS
Operational
Customer Portal
Operational
Safe Harbor Updates
Operational
Data Centers & Network
Operational
Southfield, MI (MEL)
Operational
Dearborn, MI (OTR)
Operational
San Jose, CA (SJC)
Operational
Miami, FL (MIA)
Operational
Surrey, UK (LHR)
Operational
West Sussex, UK (LGW)
Operational
Amsterdam, NL (AMS)
Operational
Sydney, AU (SYD)
Operational
Lansing, MI (DC3)
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.
Scheduled Maintenance
Nexcess EADN Origin Shield Maintenance Aug 26, 2026 22:00-23:00 EDT
Nexcess System Engineers will be performing scheduled maintenance on Edge Application Delivery Network (EADN) Origin Shields that provide the Nexcess CDN Service available in the Managed Wordpress, Managed Woo Commerce, and Managed Magento customer portals. EADN Web services will be reloaded during the window which may cause a brief (< 1min) packet loss, latency, or reconnection for websites using the built-in CDN service.
Our support team is on hand should you need any assistance or have any questions or concerns. You can reach us through the following channels:
Live Chat: https://my.nexcess.net/
Email: support@nexcess.net
We appreciate your patience and understanding as we complete this maintenance.
Internal System Maintenance Reference: CC-13718
Posted on Aug 24, 2026 - 16:04 EDT
Our support team is on hand should you need any assistance or have any questions or concerns. You can reach us through the following channels:
Live Chat: https://my.nexcess.net/
Email: support@nexcess.net
We appreciate your patience and understanding as we complete this maintenance.
Internal System Maintenance Reference: CC-13718
Posted on Aug 24, 2026 - 16:04 EDT