+0:25 UTC – Let’s Encrypt SSL Certificates are now being issued for all Pressable sites. If you have any questions please contact help@pressable.com
21:07 UTC – Currently a small number of sites on the Pressable platform are experiencing a delay with Let’s Encrypt SSL certificates. If your site does not convert to https:// after adding a domain please contact support at help@pressable.com.
Howdy,
We received notice this afternoon that our provider, Rackspace, has identified a vulnerability in Xen Hypervisor. This vulnerability has been patched by Rackspace but it requires a reboot of cloud servers in order to for it to take.
You can read more about the vulnerability and requirements here:
https://community.rackspace.com/general/f/53/t/5187
http://venom.crowdstrike.com
We have elected to reboot cloud servers in our network at our discretion rather than allowing Rackspace to reboot using a maintenance window approach.
We will begin the process of rebooting cloud servers tonight, May 13th, at 10:00 PM Central time. We expect this process to take several hours and customers will see intermittent outages of varying length.
We will update this page when the maintenance is completed.
If you have any questions or concerns, please contact our help desk.
We apologize in advance for any inconvenience this may cause and are working toward addressing this as smoothly as possible.
Thank you!
UPDATE – May 14th, 2015 @ 2:57 AM Central: We have completed the reboots that are necessary as a part of this vulnerability patch. All systems are back up, running, and stable. Thank you for your patience and please let us know if you have any questions. Thanks!
The Sucuri Blog has notified users of multiple WordPress plugins that are vulnerable to Cross-site Scripting (XSS) attacks. Listed are some of the more popular plugins used in the WordPress community:
The nature of this vulnerability makes it difficult to patch completely/comprehensively because so many plugins use the functions listed as being misused.
We highly recommend logging into your WordPress Dashboard and updating any plugins that have available updates.
If you have any questions or concerns, please contact our help desk by submitting a ticket via your https://my.pressable.com panel.
A new vulnerability has been discovered in the very popular WordPress SEO by Yoast plugin. Our systems have already begun updating this plugin across all impacted sites on our systems, and we expect this process to be completed shortly.
UPDATE 6:15PM CST: At this time all sites on our systems have been updated to the latest (patched) version of WordPress SEO by Yoast.
This is a notice that Rackspace will be performing critical security related updates to many cloud server host machines in order to patch vulnerabilities in Xen Hypervisor.
You can read more about this maintenance here:
https://community.rackspace.com/general/f/53/t/4978
These patches/updates will require host machines to be rebooted, subsequently causing cloud servers hosted on them to require a reboot as well.
As it relates to our customers, here are the maintenance windows that we have been provided with and can expect we will begin seeing server reboots occur based on cluster:
To find out which cluster your sites are on, please reference our knowledge base article on identifying which cluster your site is on.
We definitely understand these kinds of outages are not ideal but we are hoping this early notice is helpful in the way of being able to notify your users, visitors, and customers.
If you have any questions, please feel free to contact the help desk via your my.pressable.com control panel.
Thank you!
A very recently publicized vulnerability in JetPack has been patched in the latest version. As a result of this update, we’ll be updating all installs of JetPack on our systems to the latest version. You can read more here:
http://jetpack.me/2014/04/10/jetpack-security-update/
It’s important to note that we’ve been working with the team at Automattic and other hosting providers to block this type of attack so things are secure. However, updating will be the most secure course of action.
There is no action needed on your part, but if you have questions, please feel free to email help@pressable.com.
On Sunday, July 28th, 2013 at 9:05pm CST it was brought to our attention that a un-authorized disclosure vulnerability existed in our database cluster. By 9:25pm CST our team rolled out a fix to prevent this disclosure. Our team strives to immediately identify and resolve any security vulnerabilities.
The specific issue allowed an existing ZippyKid customer to view the contents of another customer database in MySQL. This database was mistakenly used by our technicians in the process of troubleshooting customer issues.
It is important to note that no sensitive data was stored in an unencrypted form in the database that was mistakenly made available. However, we have advised the customers impacted of any steps they may need to take.
Our teams are constantly working and monitoring our systems for potential security issues. However, if you do discover an issue, we appreciate the responsible disclosure of these issues to security@zippykid.com.
If you have any questions, please feel free to contact the support team at help@zippykid.com. Thanks for your continued support.
We’re removing a plugin that is known to put malware onto our customers sites off our systems. This will be in effect until the plugin has been re-instated at WordPress.org. Please see this blog post by Sucuri for more details on what this plugin does.
Pressable Status Blog 