We’ve completed the builds onto NS1.CORP and NS2.CORP, and have synced all zones to them.

The new machines will be monitored through the weekend before closing this out. Thank you.

Kernels have been upgraded and VMs rebooted in order to remove live-patched delta against:
CVE-2026-99999 & CVE-2026-98432 & CVE-2026-72389 & CVE-2026-53266 & ZDI-CAN-33367.

• M-VPS Primary: 4.18.0-553.180.1.lve.1.el8.x86_64
• M-VPS Fallback: 4.18.0-553.177.1.lve.1.el8.x86_64
• M-DNS Primary: 4.18.0-553.183.1.el8_10.x86_64
• M-DNS Fallback: 4.18.0-553.177.1.el8_10.x86_64

“Infinity Core” vulnerabilities do not impact CloudLinux v8 (only v9/10) so do not impact Merlot.
CVE-2026-98260 & CVE-2026-98256 & CVE-2026-89754 & CVE-2026-80775 all relate to same.
Note: We follow the lifecycle, which supports CL8 until 31st May 2029, then CL9 until 31st May 2032.

WordPress has a new RCE vulnerability, during upgrades only. Please ensure you patch WP.
CVE-2026-119977 is the during-upgrade RCE. It’s separate to CVE-2026-63030/60137 before.
Note: We forced updates for 63030/60137, though we won’t for 119977 due to upgrade-only scope.

Firewall Policies on Hypervisors are scheduled to be deployed before this weekend is out.
Two clients have opted to be early to go-live with these (thanks!) - they will proceed firstly.

We’ve re-built all RAID configurations on the NAS to use many RAID-Z1 (4-wide) arrays, up from 3-wide.

There is also now a hot-spare amongst the configuration, meaning if a disk fails, the system will swap-out & into service. This retains the 3-way SSD Mirror for small-block (metadata etc) I/O performance improvements. Work continues on final configuration now we’re at a hardware resting state, then integrating with DirectAdmin.