Two critical PHP vulnerabilities have a fix scheduled for today. CVE-2026-109618 and CVE-2026-109619 are both rated CVSS 9.2 and allow remote code execution without authentication on default PHP installs. Details leaked before the fix, so exploits are already in the wild. PHP has scheduled the patches for 14:00 UTC. Here's where things stand for RunCloud users: - We've disabled session.upload_progress on all servers as a temporary mitigation. It closes the known attack route until official fixes land. Uploads still work; the only side effect is that PHP-based upload progress bars may stop updating. - Once PHP publishes the fixes, patches will be applied automatically to PHP 8.2 and newer. Timing depends on your stack (native, Docker, OpenLiteSpeed/LiteSpeed Enterprise), and we'll post updates as each one ships. ⚠️ If you run PHP 8.1 or older, switch your web apps to 8.2+ now. Those versions are end-of-life and won't receive an official fix. The mitigation stays active on them, but it's no substitute for upgrading. Optional: We've released two NGINX templates that block or rate-limit multipart requests before they reach PHP. Pick the one that fits your site. Full details, WordPress-specific guidance, and live patch status for every stack: community.runcloud.io/t/crit…

🆕 Introducing Web Terminal: Access Your Server Shell in the Browser 𝗡𝗼𝘁𝗲: Web Terminal is off by default. Workspace owners can enable it with an 8-digit code sent via email, and each session requires a new 2FA challenge. Learn more & get started: runcloud.io/docs/category/we…

🆕 𝗜𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝗶𝗻𝗴 𝗚𝗹𝗼𝗯𝗮𝗹 & 𝗥𝗲𝘀𝗼𝘂𝗿𝗰𝗲-𝗟𝗲𝘃𝗲𝗹 𝗡𝗼𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗣𝗿𝗲𝗳𝗲𝗿𝗲𝗻𝗰𝗲𝘀 Choose which of 33+ notification types RunCloud sends, per server, and pick the channel for each: - Email - Slack - Telegram - Discord - Webhook runcloud.io/docs/customizing…

🆕 We rebuilt the RunCloud Web Server Log UI. No more walls of raw text. You now get: • A structured, searchable table • An interactive timeline with click-to-jump • Filter by IP, path, status code, or HTTP method • One-click copy & download runcloud.io/docs/access-web-…

🆕 𝗟𝗶𝘁𝗲𝗦𝗽𝗲𝗲𝗱 𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝗦𝘂𝗽𝗽𝗼𝗿𝘁 𝗶𝘀 𝗡𝗼𝘄 𝗶𝗻 𝗕𝗲𝘁𝗮 LiteSpeed Enterprise is now available as a beta as the third web server stack alongside NGINX and OpenLiteSpeed. If you've been waiting for LSCache, built-in WAF, QUIC.cloud, and better performance under load with the convenience of RunCloud server management, this one's for you. Deploy a new server with LiteSpeed Web Server, bring your own license, and manage everything from your RunCloud dashboard. Learn more: runcloud.io/docs/litespeed-e…

🆕 𝗥𝘂𝗻𝗖𝗹𝗼𝘂𝗱 𝗔𝗜 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 𝗶𝘀 𝗵𝗲𝗿𝗲 (𝗕𝗲𝘁𝗮) RunCloud AI Monitoring continuously analyzes your server to detect anomalies and their severity, diagnose root causes, and surface remediation steps you can act on immediately. Think of it as having an L3 sysadmin watching your server around the clock. When something goes wrong, you get a full diagnosis of what's happening, why, and the exact steps to fix it. How it works: - Read-only by design. It observes and advises. It never runs commands or makes changes automatically. - You stay in control. Any suggested commands and next steps are for you to review and run manually. - AI isn't perfect. Recommendations may be incomplete or incorrect. Always verify before making changes. To enable it, head to any Server in your dashboard, and you'll find a new "Install RunCloud AI" option. Learn more: runcloud.io/docs/ai-monitori… 𝗡𝗼𝘁𝗲: This is a beta, so we want your feedback. If you try it and spot something off (a diagnosis that missed the mark, a remediation step that didn't work, a use case we should cover), let us know. We look forward to any & all feedback.

🆕 🎉 RunCache is Now in Beta Full-page, object, and edge caching for WordPress in one plugin. WooCommerce-ready, Cloudflare edge caching built in, works with Apache and NGINX, and more. 𝗡𝗼𝘁𝗲: To get started, ensure your server is running RunCloud Agent 2.17.10 (or later). From there, navigate to your web application(s) of choice and to the Performance (Beta) tab or, if you already have RunCloud Hub installed, to the RunCloud Hub tab, where you will be prompted to upgrade eligible web applications.

🆕 The RunCloud File Manager now supports file uploads, bulk actions, and more. You can now upload files directly to your servers from the File Manager in your RunCloud dashboard. 🎉 𝗡𝗼𝘁𝗲: Requires agent version 2.17.0 or above. See it in action: youtu.be/nP_Nx4eAaMU Read the docs: runcloud.io/docs/file-manage…

⚠️ "Copy Fail" Linux Kernel Vulnerability: CVE-2026-31431 A critical Linux kernel vulnerability was publicly disclosed on April 29. It affects every major Linux distribution (including Ubuntu 24.04, 22.04, and 20.04), and allows any user with shell access to gain full root access. We've already pushed an interim fix to servers via the RunCloud agent where possible. For verification steps and instructions on manually applying the interim fix, here's the full write-up on our community forum: community.runcloud.io/t/cve-… community.runcloud.io/t/cve-…

🆕 𝗥𝘂𝗻𝗖𝗹𝗼𝘂𝗱 𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝗡𝗼𝘄 𝗦𝘂𝗽𝗽𝗼𝗿𝘁𝘀 𝗨𝗽 𝘁𝗼 𝟱 𝗪𝗼𝗿𝗸𝘀𝗽𝗮𝗰𝗲𝘀 This has been one of the most requested features since we introduced Workspaces, advanced user & role management, and API v3. Now live for all Enterprise users. runcloud.io/changelog

𝗜𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝗶𝗻𝗴 𝗪𝗲𝗯 𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗠𝗮𝗶𝗻𝘁𝗲𝗻𝗮𝗻𝗰𝗲 𝗠𝗼𝗱𝗲 🚧 🎉 Perfect for maintenance, migrations, or pausing unused sites – with all files and configurations preserved. runcloud.io/docs/web-app-mai…

We’re excited to be at WordCamp Malaysia 2025 🇲🇾 Drop by our booth, grab some goodies, and ask us about RunCache, our hybrid caching plugin that makes enabling and managing both application and server side caching easy for everyone. It’s launching soon on the WP repo and will be free even for non RunCloud users. You can also claim an exclusive 40% discount to take RunCloud for a test drive 👉 manage.runcloud.io/offers/wc… See you there 🚀 #WCMY25