Kernels have been upgraded and VMs rebooted in order to remove live-patched delta against:
CVE-2026-99999 & CVE-2026-98432 & CVE-2026-72389 & CVE-2026-53266 & ZDI-CAN-33367.

• M-VPS Primary: 4.18.0-553.180.1.lve.1.el8.x86_64
• M-VPS Fallback: 4.18.0-553.177.1.lve.1.el8.x86_64
• M-DNS Primary: 4.18.0-553.183.1.el8_10.x86_64
• M-DNS Fallback: 4.18.0-553.177.1.el8_10.x86_64

“Infinity Core” vulnerabilities do not impact CloudLinux v8 (only v9/10) so do not impact Merlot.
CVE-2026-98260 & CVE-2026-98256 & CVE-2026-89754 & CVE-2026-80775 all relate to same.
Note: We follow the lifecycle, which supports CL8 until 31st May 2029, then CL9 until 31st May 2032.

WordPress has a new RCE vulnerability, during upgrades only. Please ensure you patch WP.
CVE-2026-119977 is the during-upgrade RCE. It’s separate to CVE-2026-63030/60137 before.
Note: We forced updates for 63030/60137, though we won’t for 119977 due to upgrade-only scope.

Firewall Policies on Hypervisors are scheduled to be deployed before this weekend is out.
Two clients have opted to be early to go-live with these (thanks!) - they will proceed firstly.

We’ve re-built all RAID configurations on the NAS to use many RAID-Z1 (4-wide) arrays, up from 3-wide.

There is also now a hot-spare amongst the configuration, meaning if a disk fails, the system will swap-out & into service. This retains the 3-way SSD Mirror for small-block (metadata etc) I/O performance improvements. Work continues on final configuration now we’re at a hardware resting state, then integrating with DirectAdmin.