alexhost.com | VPS, Dedicated & GPU Servers

⚠️ Three critical vulnerabilities this week, and none of them were in your code PHP, Plesk and VMmanager 6 all got serious holes in the same week. Each one sits in a layer under the site that owners rarely check, and each one has a spot where "everything is updated" turns out to be wrong. 🐧 PHP: CVE-2026-109618 and CVE-2026-109619

▎Rated 9.2. One request without any login lets an attacker run code on the server, before your application code even starts ▎Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 ▎The trap: php -v shows the command-line PHP. Your site may run on a different PHP-FPM build, and running workers keep the old code until you restart them What to do ↳ update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from your distribution's packages ↳ restart PHP-FPM or the web server, for example systemctl restart php8.3-fpm on Debian or Ubuntu ↳ check the version the site actually serves with a temporary phpinfo() page, then delete it ↳ on 8.1 or older, plan the move to a supported branch

💻 Plesk

▎Every PHP build shipped with Plesk was affected, fixes came out the same day ▎The trap: the fixed 7.4.33, 8.0.30 and 8.1.34 carry the same version number as the vulnerable ones. Only builds from 21 October include the fix ▎The panel runs on its own PHP engine, sw-engine, and updating PHP for your sites doesn't touch it What to do ↳ install the latest Plesk update in Tools & Settings > Updates, then check that plesk version shows 18.0.81 Update 4 or 18.0.80 Update 11 ↳ update every PHP version the server uses, and for 7.4, 8.0 and 8.1 make sure the build is dated 21 October

🔑 VMmanager 6

▎A vulnerability in this virtualization platform was exploited at a hosting provider. ISPsystem confirmed the incident on 20 October and hasn't announced a full fix yet ▎A platform like this can read the disks of every server it runs. Passwords in configs, SSH keys, tokens in .env and your .bash_history all live on that disk ▎A patch closes the hole, and leaked keys keep working until they're replaced What to do ↳ if your provider uses it and warned you: change root and panel passwords, generate new SSH keys and delete the old ones from authorized_keys, rotate API tokens, cloud keys and database passwords ↳ if you run it yourself: install updates as ISPsystem releases them and allow access to the platform and SSH only from trusted IPs

On our side everything is already updated. If you run your own VPS, the PHP and panels inside it are yours to update. 🔗 PHP advisory: https://www.php.net/archive/2026.php#2026-10-21-5 🔗 Plesk: https://support.plesk.com/hc/en-us/articles/44397729587351 🔗 ISPsystem: https://www.ispsystem.ru/news/vulnerability-incident

🇷🇴 Our team has completed another infrastructure upgrade at the NXDATA-2 data center in Bucharest, Romania:

▎expanded network infrastructure ▎improved connectivity and redundancy ▎higher infrastructure reliability ▎more capacity for future growth

Why it matters for business: when a network has a single path or runs close to its capacity limit, one failure or one traffic spike is enough to slow down or stop the services your company depends on. For companies running production workloads on AlexHost (AS200019), this upgrade means a network with more headroom and fewer single points of failure. Reliable hosting starts with a strong network.

💾 Ransomware almost always goes after your backups ▎How often attackers go for the backups.

In Veeam's 2025 ransomware study of 1,300 organizations, 89% of victims had their backup repositories targeted. On average, attackers changed or deleted 34% of those repositories, and fewer than 10% of companies got more than 90% of their servers back as fast as they expected (Veeam)

▎What it looks like in a real attack.

In August 2026, CISA described a ransomware group that switches off backup features before encrypting anything. At one victim it deleted the backups and archives in both the main data center and the disaster recovery site, once before the attack and once after. The single encryption key they stole from an access control server unlocked the company's server passwords. Their advice is to keep offline backups that can't be changed, in a physically separate location, and to test them (CISA)

▎When the hunt for backups begins.

In Q2 2026, incident responders saw attackers exploring the victim's network in 52% of cases. They treat this kind of activity near backup systems as a sign that the attack is about to escalate (Coveware by Veeam)

▎How often backups actually save the day.

Sophos surveyed 2,158 companies in early 2026. Attackers managed to encrypt data in 56% of attacks, and 66% of those companies got their data back from backups, up from 54% a year earlier. 48% of them paid the ransom (Sophos)

🧠 One last thing before you go: a short quiz about how fast a break-in turns into a ransomware attack. Try it without googling.

💻 Worth the stars | DiskTree Anyone can build a tool in one evening now. Deciding whether to install it still takes a minute of thought.

tobi/disktree ⭐ 2.9k · MIT · v0.11.0

🧠 On September 24 Shopify's CEO Tobi Lütke posted: "Was wondering where my disk space went. Therefore this exists now. You can simply wish software into existence." The post got 1.3M views. The top reply, with 7.5k likes, asked why nobody just downloads WinDirStat or TreeSize anymore. DiskTree draws your disk as a map where each folder's area is the space it really takes. Caches and build output get a hatch. You mark what should go, review the list, and only then send it to Trash or delete it for good. It refuses to touch your home folder, mount points and system trees, and for a git checkout it shows unpushed commits before you mark it. What it won't do - worth knowing before you install:

▎it won't open without a graphical session and a GPU that runs Vulkan ▎root on an SSH-only server doesn't change that ▎the "reclaimable" hatch is a guess based on folder names ▎it's three weeks old and changes weekly, the AUR package lags behind

✅ Verdict: worth it - if all three are true

▎you work on a Linux desktop ▎your GPU runs Vulkan ▎you want to see the disk before you clean it

On a server you reach over SSH, skip it. ncdu or dust will show you the same picture in a terminal. We wrote a full breakdown: 🔗https://alexhost.com/info/disktree-explained-visualizing-what-eats-your-storage/

Taking a website down now takes one sentence in a chat window ❌ Someone is angry at your project. A client who didn't get a refund, or a competitor a week before Black Friday. ↳ A year ago they would have had to understand what a SYN flood is. Now they open a DDoS-for-hire site, and a chat assistant is waiting for them there. 🤖 One of these assistants works like this. The customer types the goal in plain words, something like "disrupt this site during business hours in Europe", and the bot picks the attack type, timing and settings. ↳ If your site holds up, the bot suggests what to try next, for example "try targeting their API endpoints instead". 📈 What the reports show

▎On underground forums, mentions of malicious AI tools grew by 219%. Cloudflare put it plainly in its 2026 report: AI is making it easier for anyone to launch sophisticated attacks. ▎Sometimes nobody has to order anything at all. Fastly saw AI bots that load pages for ChatGPT and Perplexity users send over 39,000 requests a minute to a single site. For a small server that looks exactly like an attack. ▎Most attacks are short, too. 90.6% of the ones Cloudflare stops are over in less than 10 minutes, so by the time you read the alert, your protection has already done its job on its own or failed to.

Every AlexHost service comes with DDoS protection. If you're choosing a server for a project that can't afford to go down, start here: 🔗 alexhost.com/ddos-protected-vps

💻 The automation works. Then it becomes your second job. Nobody writes that part in the tutorial. A comment under one of those videos says it better than we could: "It worked. Until it became my second job. Scenarios broke silently. Only I could fix them." We run n8n ourselves - on our own VPS boxes, until something breaks at an inconvenient hour. So here are 4 guides, in the order you'll actually need them.

▎Make vs Zapier vs n8n - what each one charges you for: tasks, credits, or executions. The meter matters more than the logo. 🔗 https://alexhost.com/faq/make-vs-zapier-vs-n8n-which-automation-platform-fits-you-best-in-2026/ ▎Deploy n8n on a Debian 12 VPS - the full install, done once, done properly. 🔗 https://alexhost.com/faq/how-to-deploy-n8n-on-debian-12-vps/ ▎Handling complex automation with n8n - when one workflow turns into fifteen and the retries start piling up. 🔗 https://alexhost.com/faq/handling-complex-automation-more-effectively-with-n8n/ ▎n8n AI agent tutorial - from a prompt to structured workflow data you can actually route. 🔗 https://alexhost.com/faq/n8n-ai-agent-tutorial-from-simple-prompt-to-structured-workflow-data/

One honest note before you start: read the comparison first. If your workflow runs twice a day, the cloud tier is cheaper than your Saturday. Self-hosting pays off when the meter starts to hurt - not before. 📚 Everything else we've written - Linux, networking, security, web: 🔗 https://alexhost.com/faq/

⚠️ We found fake accounts impersonating us

Our only official account: @alexhost_on

Scan the QR code or follow the link: t.me/alexhost_on If a similar-looking account contacts you, check the username character by character. If anything feels off, message us at @alexhost_on and we'll confirm.

💻 Cybersecurity Awareness Month starts today, and we'll spend it on what actually takes servers down For the next four weeks we'll take one topic at a time, in this order:

▎Week 1: DDoS. Cloudflare blocks 128,000 attacks a day, and 90.6% are over in under 10 minutes, before anyone has time to react

▎Week 2: backups. In 94% of ransomware attacks, criminals go after the backups, and 57% of those attempts succeed (Sophos)

▎Week 3: passwords, keys and AI. 28.65 million keys and passwords leaked to public GitHub in 2025, and 64% of the ones leaked in 2022 still work (GitGuardian)

▎Week 4: vulnerabilities. For the first time in 19 years, they've overtaken stolen passwords as the most common way attackers break in (31% of breaches, Verizon)

▎Last post of the month: what to do in the first hour after a break-in

🧠 We'll start with a small quiz about the biggest DDoS attack Cloudflare has ever recorded. Try to answer without googling.

✅ The DDoS incident is closed. A month ago we promised an official statement once every check was done. Here it is.

▎Infrastructure checks are complete ▎No signs of a data breach or unauthorized access were found ▎No ransom was paid

What we were up against: volumetric attacks peaking at 1.5 Tbps. That's the kind of traffic built to take down an entire network. What we did

▎RETN helped us push back the volumetric floods ▎As the next step, part of our critical infrastructure now also sits behind Qrator Labs — protection against both large L3/L4 floods and L7 attacks, the ones that target websites and applications directly

We're not done. We keep investing in the network so AlexHost services stay available even during large, complex attacks. Thank you to everyone who waited for this update. — AlexHost Team

⚠️ Critical WordPress vulnerability: update to 7.1.2 WordPress shipped 7.1.2 on September 22. It fixes one bug - CVE-2026-87902, CVSS 4.0: 9.2. The bug is in page template resolution. WordPress builds a template filename straight from the pagename parameter in the URL and skips validate_file() for it. If the value is double URL-encoded, it gets through sanitization, and WordPress includes a PHP file from outside the theme folder. No login required.

Affected: every version from 4.7.0 to 7.1.1.

Full RCE needs two things on the server:

▎ a top-level page- directory in the active theme ▎ register_argc_argv enabled in PHP

Chances are you have both. register_argc_argv is on by default in the official PHP Docker image and in many cPanel setups on PHP < 8.5. Twenty Twelve and Twenty Fourteen ship with top-level page-* directories. What to do

▎ Update to 7.1.2 ▎ On an older branch — backports are out, including 7.0.6 and 6.9.9, and patches go back to 4.7.37

🔗 https://wordpress.org/news/2026/09/wordpress-7-1-2-release/

VPS stock is back. All 9 locations. Hardware is racked now. Stock's back everywhere:

▎🇲🇩 Moldova ▎🇳🇱 Netherlands ▎🇸🇪 Sweden ▎🇨🇭 Switzerland ▎🇫🇷 France ▎🇷🇴 Romania ▎🇬🇧 United Kingdom ▎🇺🇸 USA

Check out the plans: 🔗https://alexhost.com/vps/ 🔥 VPS Platinum is live again too.

↳ Intel Xeon Platinum 8268 ↳ NVMe storage ↳ 1 Gbps port ↳ KVM virtualization ↳ Datacenter in Moldova. ↳ Configurations from 1 to 16 vCores, 2 to 32 GB RAM.

Check out the plans and deploy in minutes 🔗 https://alexhost.com/vps/platinum-vps/

💻 Worth the stars | Anubis Your server isn't slow. It's working for someone's training set.

▎TecharoHQ/anubis ▎⭐ 22.5k · MIT · v1.27.0

⚖️ Anubis sits in front of your app and gives every client a small proof-of-work task. A real visitor solves it once and gets a cookie. A scraper switching IPs pays again every time. Xe Iaso built it in January 2025, after AmazonBot ignored robots.txt and kept knocking a git server offline. Still maintained, last release in August. What it won't do - worth knowing before you install:

▎it's not a WAF, CDN or DDoS shield ▎headless browsers can solve the challenge ▎search and archive bots need allowlisting ▎no-JS visitors get a weaker fallback

✅ Verdict: worth it - if all three are true

▎your site is public ▎scrapers are actually costing you CPU ▎you control the reverse proxy Otherwise, skip it.

Full breakdown: 🔗 https://alexhost.com/faq/anubis-ai-scraper-firewall-stop-bots-protect-your-website-cut-hosting-costs/

🐧 People keep comparing Omarchy and CachyOS, but they solve different problems. Both are based on Arch, and both have been getting a lot of attention this year. We wrote a guide comparing them. Here are the main points.

▎ Omarchy focuses on the desktop. You get Hyprland and a setup that's already configured, with everything controlled from the keyboard. Updates go through its own menu, and it takes a snapshot before each one. ▎ CachyOS focuses on performance. Packages are rebuilt for x86-64-v3, v4 and Zen4+, the kernel is tuned, and chwd sets up your drivers. You pick the desktop yourself: KDE, GNOME, Hyprland or another option.

📖 The guide also looks at whether you can run Omarchy on top of CachyOS: 🔗https://alexhost.com/faq/omarchy-vs-cachyos-which-arch-based-linux-fits-you-better-in-2026/ If you want to test CachyOS or Omarchy on server hardware, a dedicated server works well for that. You can install any OS on ours: 🔗https://alexhost.com/dedicated-servers/

For everyone still concerned about the DDoS attack: the situation is under control and services have been restored. We're now verifying every part of our infrastructure before confirming the incident is closed, and we'll publish an official statement once those checks are complete. Thank you for your patience and trust.

✅ GDPR NOW IN MOLDOVA On 23 August 2026, Law 195/2024 entered into force, replacing Law 133/2011 and bringing the EU's GDPR into Moldovan law. If you collect personal data - names, emails, phone numbers, even IPs - you're in scope, whether your users sit in Moldova or the EU. In plain terms, the law asks you to:

▎ Know your data: keep a record of what you collect, why, and where it goes. ▎ Have a lawful reason for every use - no collecting "just in case." ▎ Respect user rights: people can see, correct, or delete their data, and you have one month to respond. ▎ Secure it: encryption, access control, working backups - measures actually in place, not a policy nobody follows. ▎ Report breaches: if data is exposed, there's a duty to notify, and the clock is short. ▎ Cover your vendors: anyone processing data for you (host, email, analytics) should be under a DPA.

🔴 We have already had most of those at AlexHost but now it's official and part of the law, our infrastructure and processes are already aligned and running. Need a DPA or details on our security and data residency? You can check those out here: 🔗https://alexhost.com/dpa/

⚠️ Official AlexHost Update - Ongoing DDoS Attack Since Saturday, August 22, AlexHost has been experiencing a large-scale DDoS attack affecting parts of our network infrastructure and causing service disruptions for some customers. Our technical teams are actively mitigating the attack together with our upstream providers and Anti-DDoS partners, while services are being restored progressively. There is currently no indication of a data breach or unauthorized access. This is an availability and connectivity issue. Individuals claiming responsibility for the attack have demanded a ransom. AlexHost will not pay or negotiate with attackers. Our resources will be invested in protecting our customers, strengthening our infrastructure, and improving mitigation capacity - not in rewarding those attempting to disrupt our services. All actions taken by AlexHost remain strictly within the law and established cybersecurity practices.

⚠️ If anyone contacts you offering to stop the attack or restore your services in exchange for payment, do not pay, do not share credentials, and report the message to our official support team.

Our priority remains clear: protect our customers, restore services, and strengthen our network. Thank you for your patience and continued trust. — AlexHost Team

💻 The hardest thing to buy right now isn't GPUs. It's memory. The industry already has a name for it: RAMageddon. Ask the big datacenters what's blocking them — they don't say power, or space, or chips. They say RAM. Micron admits it can fill less than half of the datacenter demand it's asked for. Memory is roughly a quarter of what an AI server rack costs to build, and the hyperscalers are buying anyway. Their 2026 spending is on track to be double what they planned back in January.

Everyone else pays for that: ▎A DDR4 chip that sold for $16 in April went past $42 in early August — an all-time high ▎A 64GB DDR5 server module went from $255 in Q3 last year to above $900 by Q1 ▎The three big makers are pushing capital spending from $43B in 2024 to a projected $146B in 2027

So server prices are climbing everywhere. We're not raising ours. 🔴 That's the whole idea of AlexHost. Running since 2008, through more than one cycle like this. The infrastructure under you is supposed to be the stable part.

🧠 Renting the server is the fast part. Learning to live on it takes a year - and that year is barely written down. Linux documentation comes in two useless kinds: man pages for people who already know, and "what is an operating system" for people who don't. The person who rented a VPS yesterday sits exactly between them. So we wrote the in-between part, in the order you'll need it:

🐧 How to Choose Your Perfect Linux Distro — one guide says apt, your server says dnf, and nobody explains why 🔗 https://alexhost.com/info/how-to-choose-your-perfect-linux-distro/ 🔌 SSH, RDP, VNC — three ways in, and the familiar one is often the wrong one 🔗 https://alexhost.com/faq/how-to-access-a-remote-computer-or-server-ssh-rdp-vnc-and-when-to-use-each/ ⌨️Your First Week on a Linux Server — 35 commands, because the four you know won't get you through it 🔗 https://alexhost.com/faq/your-first-week-on-a-linux-server-35-essential-commands/ 💻 Using tmux — the connection drops and takes the running process with it 🔗 https://alexhost.com/faq/using-tmux-a-terminal-multiplexer/

🌟 Everything else we've written — Linux, networking, security, web: 🔗 https://alexhost.com/faq/