Compromised sites at Pantheon: 8 questions to ask your web host
On September 29, 2026, US web host Pantheon, which specializes in WordPress and Drupal sites, spotted malicious activity: an attacker had taken control of a customer website and was using it to target the platform itself. From that site, the attacker tried to exploit a Linux kernel flaw (CVE-2026-53362) on the application servers. Some sites saw brief interruptions.
On October 2, Pantheon updated its account: not one, but “a small number” of customer sites were affected, each first compromised through a weakness in its own application. The host says it found no evidence that other customers’ sites or data were accessed. It deleted the compromised site, accelerated its kernel updates and added protections.
The takeaway for your SMB
Website security comes down to two doors: your host’s (servers, kernel, walls between customers) and yours (WordPress, plugins, theme, accounts). Web hosting security depends on both. A forgotten plugin on your side can become a springboard against the host… and its other customers. Pantheon has not disclosed how many sites were affected or which weakness was used first.
The script: 8 questions to ask your web host about web hosting security
Copy these questions into an email to your host (or the agency that manages your site). The answers will tell you who handles what, and where the gaps are.
1. “How long does it take between the release of a critical operating system or kernel patch and its installation on your servers?”
Why ask: The flaw targeted at Pantheon (CVE-2026-53362) had been public since July 1, 2026, according to Red Hat. Pantheon says it accelerated updates that were already in progress.
A good answer looks like: a specific, written timeframe, and an emergency process for actively exploited flaws.
2. “How is my site isolated from other customers’ sites?”
Why ask: Red Hat describes CVE-2026-53362 as a flaw that allows escaping from a container to the host server with root rights. If a neighbouring site is compromised, that wall is what protects you.
A good answer looks like: a clear explanation (container, virtual machine, dedicated server) and what happens when that wall is threatened.
3. “Who updates WordPress, plugins and the theme: you, me or my agency?”
Why ask: At Pantheon, each affected site was first compromised through a weakness in its own application. That’s the door the host usually doesn’t watch for you.
A good answer looks like: a name, a frequency and written confirmation. “It happens automatically” is not an answer.
4. “How, and how fast, will I be notified if my site or the platform is affected?”
Why ask: Pantheon notified the affected customer directly and posts updates on its status page. Make sure the contact address on file is actually read by someone.
A good answer looks like: a notification channel (email, a status page you can subscribe to) and a timeframe.
5. “Where are my backups, how long do you keep them, and have I ever tested a restore?”
Why ask: Pantheon deleted the compromised site. If that happens to you, the backup is what brings your site back online.
A good answer looks like: backups kept somewhere other than the same server, several days of history, and a tested restore.
6. “Which logs do you keep, and will I have access to them during an incident?”
Why ask: Without logs, there’s no way to know how the attacker got in or what they touched.
A good answer looks like: web and access logs kept for a set period, available on request.
7. “If my site is compromised, who handles cleanup and credential rotation?”
Why ask: Pantheon is working with affected customers on cleanup and credential rotation (database passwords, API keys, admin accounts).
A good answer looks like: a clear split of tasks, and what’s included or billed extra.
8. “In which country are my data and my clients’ data hosted?”
Why ask: If your site collects personal information (forms, client accounts), Quebec’s Law 25 expects you to know where it goes. This is not legal advice.
A good answer looks like: a country, a data centre region, and the list of subcontractors.
And on your side: what the host won’t do for you
Pantheon reminds all its customers of this, and the advice applies to any host:
- Update your CMS core, plugins, themes and modules.
- Remove plugins and themes you don’t use, and old sites you no longer need (old versions, test sites).
- Review who has admin access and which credentials still exist.
- Report any unexpected code, deployment or change on your site.
Do you host other web tools yourself (portal, ticketing tool)? The same logic applies: see our article on the Zammad vulnerability. And if you’re wondering whether your SMB looks like an easy target, read 5 signs your SMB is an easy target.
How NeoTech can help
For SMBs in Laval, Montréal and the North Shore, we can send these questions to your host with you, review the answers, then take over your site updates and tested backups. Our automated 24/7 monitoring with an on-call technician response spots unexpected changes. See also our cybersecurity services.
Book your free cyber check
Not sure who updates your website, or where your backups are? In a short meeting, we review it with you and prioritize the fixes.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Pantheon — Security Advisory: Malicious Activity Affecting Platform Hosts (updates October 1–5, 2026)
- Red Hat — RHSB-2026-009, IPv6 Fragmentation Container Escape (CVE-2026-53362)
- NVD — CVE-2026-53362
- Security.io — Pantheon widens affected-site count in platform-host incident (October 5, 2026)
Photo: Panumas Nik (Pexels).