{
  "is": "issue",
  "title": "Websites are returning 403 errors from OpenResty on POST requests",
  "body": "\u003cp\u003e\u003cem\u003eIdentified\u003c/em\u003e - iFastNet is currently preparing the PHP updates. Once they are ready, they will be rolled out to all servers, and the temporary block on \u003ccode\u003emultipart/form-data\u003c/code\u003e POST requests will be lifted. They expect to be able to complete this within two hours. \n  \u003cspan class=\"faded\"\u003e(22 Oct - 08:57 UTC)\u003c/span\u003e\n\n\u003c/p\u003e\n\u003chr\u003e\n\u003cp\u003e\u003cem\u003eIdentified\u003c/em\u003e - CloudLinux has released updated PHP packages over the night to address the vulnerabilities. We are trying to get confirmation from iFastNet about when these updates will be rolled out. \n  \u003cspan class=\"faded\"\u003e(22 Oct - 08:47 UTC)\u003c/span\u003e\n\n\u003c/p\u003e\n\u003chr\u003e\n\u003cp\u003e\u003cem\u003eIdentified\u003c/em\u003e - We have received confirmation from iFastNet about this issue.\u003c/p\u003e\n\u003cp\u003eEarlier today, a critical update to PHP was released that fixes two severe security issues. These issues could cause serious harm on our hosting if exploited.\u003c/p\u003e\n\u003cp\u003eOur hosting runs PHP packages provided by CloudLinux. CloudLinux has not yet distributed the fixed PHP version. We are waiting for them to provide the PHP version that contains the security fixes.\u003c/p\u003e\n\u003cp\u003eUntil then, to keep our hosting and all websites on it safe, iFastNet was forced to block certain requests from reaching PHP, which includes blocking all \u003ccode\u003emultipart/form-data\u003c/code\u003e POST requests.\u003c/p\u003e\n\u003cp\u003eThis block will remain in effect until the new PHP packages are published and rolled out on all hosting servers.\u003c/p\u003e\n\n  \u003cspan class=\"faded\"\u003e(21 Oct - 19:14 UTC)\u003c/span\u003e\n\n\n\u003chr\u003e\n\u003cp\u003e\u003cem\u003eInvestigating\u003c/em\u003e - We have investigated the issue and have a better idea of the impact.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe problem occurs when making a POST request to websites using the \u003ccode\u003emultipart/form-data\u003c/code\u003e content type. POST requests using form-urlencoded data are not affected. Other data types are unclear at this time.\n\u003cul\u003e\n\u003cli\u003eExplained simply: some forms on websites will return this error, other won\u0026rsquo;t. Notably forms that involve file uploads.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eAll accounts seem to be affected by this, regardless of website IP or domain name used.\u003c/li\u003e\n\u003cli\u003eThis issue potentially affects all website software, including WordPress and Laravel. How much functionality is impacted by this issue depends on the website software used.\u003c/li\u003e\n\u003c/ul\u003e\n\n  \u003cspan class=\"faded\"\u003e(21 Oct - 18:22 UTC)\u003c/span\u003e\n\n\n\u003chr\u003e\n\u003cp\u003e\u003cem\u003eInvestigating\u003c/em\u003e - We are currently investigating reports of 403 errors on websites on free hosting. \n  \u003cspan class=\"faded\"\u003e(21 Oct - 17:46 UTC)\u003c/span\u003e\n\n\u003c/p\u003e\n",
  "createdAt": "2026-10-21 17:46:00 +0000 UTC",
  "lastMod": "2026-10-22 10:57:36 +0200 +0200",
  "permalink": "https://status.infinityfree.com/issues/2026-10-21-403-errors/",
  "severity": "disrupted",
  "resolved": false,
  "informational": false,
  "resolvedAt": "<no value>",
  "affected": ["Websites"],
  "filename": "2026-10-21-403-errors.md"
}