⚠️ Official AlexHost Update - Ongoing DDoS Attack

Since Saturday, August 22, AlexHost has been experiencing a large-scale DDoS attack affecting parts of our network infrastructure and causing service disruptions for some customers.

Our technical teams are actively mitigating the attack together with our upstream providers and Anti-DDoS partners, while services are being restored progressively.

There is currently no indication of a data breach or unauthorized access. This is an availability and connectivity issue.

Individuals claiming responsibility for the attack have demanded a ransom.
AlexHost will not pay or negotiate with attackers.

Our resources will be invested in protecting our customers, strengthening our infrastructure, and improving mitigation capacity - not in rewarding those attempting to disrupt our services.
All actions taken by AlexHost remain strictly within the law and established cybersecurity practices.

⚠️ If anyone contacts you offering to stop the attack or restore your services in exchange for payment, do not pay, do not share credentials, and report the message to our official support team.

Our priority remains clear: protect our customers, restore services, and strengthen our network.

Thank you for your patience and continued trust.

— AlexHost Team

✅ GDPR NOW IN MOLDOVA

On 23 August 2026, Law 195/2024 entered into force, replacing Law 133/2011 and bringing the EU's GDPR into Moldovan law. If you collect personal data - names, emails, phone numbers, even IPs - you're in scope, whether your users sit in Moldova or the EU.

In plain terms, the law asks you to:

▎ Know your data: keep a record of what you collect, why, and where it goes.
▎ Have a lawful reason for every use - no collecting "just in case."
▎ Respect user rights: people can see, correct, or delete their data, and you have one month to respond.
▎ Secure it: encryption, access control, working backups - measures actually in place, not a policy nobody follows.
▎ Report breaches: if data is exposed, there's a duty to notify, and the clock is short.
▎ Cover your vendors: anyone processing data for you (host, email, analytics) should be under a
DPA.

🔴 We have already had most of those at AlexHost but now it's official and part of the law, our infrastructure and processes are already aligned and running.

Need a DPA or details on our security and data residency? You can check those out here:
🔗https://alexhost.com/dpa/

🐧 People keep comparing Omarchy and CachyOS, but they solve different problems.

Both are based on Arch, and both have been getting a lot of attention this year. We wrote a guide comparing them. Here are the main points.

▎ Omarchy focuses on the desktop. You get Hyprland and a setup that's already configured, with everything controlled from the keyboard. Updates go through its own menu, and it takes a snapshot before each one.

▎ CachyOS focuses on performance. Packages are rebuilt for x86-64-v3, v4 and Zen4+, the kernel is tuned, and chwd sets up your drivers. You pick the desktop yourself: KDE, GNOME, Hyprland or another option.

📖 The guide also looks at whether you can run Omarchy on top of CachyOS:
🔗https://alexhost.com/faq/omarchy-vs-cachyos-which-arch-based-linux-fits-you-better-in-2026/

If you want to test CachyOS or Omarchy on server hardware, a dedicated server works well for that. You can install any OS on ours:
🔗https://alexhost.com/dedicated-servers/

💻 Worth the stars | Anubis

Your server isn't slow. It's working for someone's training set.

▎TecharoHQ/anubis
▎⭐ 22.5k · MIT · v1.27.0

⚖️ Anubis sits in front of your app and gives every client a small proof-of-work task. A real visitor solves it once and gets a cookie. A scraper switching IPs pays again every time.

Xe Iaso built it in January 2025, after AmazonBot ignored robots.txt and kept knocking a git server offline. Still maintained, last release in August.

What it won't do - worth knowing before you install:

▎it's not a WAF, CDN or DDoS shield
▎headless browsers can solve the challenge
▎search and archive bots need allowlisting
▎no-JS visitors get a weaker fallback

✅ Verdict: worth it - if all three are true

▎your site is public
▎scrapers are actually costing you CPU
▎you control the reverse proxy
Otherwise, skip it.

Full breakdown:
🔗 https://alexhost.com/faq/anubis-ai-scraper-firewall-stop-bots-protect-your-website-cut-hosting-costs/

VPS stock is back. All 9 locations.
Hardware is racked now. Stock's back everywhere:

▎🇲🇩 Moldova
▎🇳🇱 Netherlands
▎🇸🇪 Sweden
▎🇨🇭 Switzerland
▎🇫🇷 France
▎🇷🇴 Romania
▎🇬🇧 United Kingdom
▎🇺🇸 USA

Check out the plans:
🔗https://alexhost.com/vps/

🔥 VPS Platinum is live again too.

↳ Intel Xeon Platinum 8268
↳ NVMe storage
↳ 1 Gbps port
↳ KVM virtualization
↳ Datacenter in Moldova.
↳ Configurations from 1 to 16 vCores, 2 to 32 GB RAM.

Check out the plans and deploy in minutes
🔗 https://alexhost.com/vps/platinum-vps/

⚠️ Critical WordPress vulnerability: update to 7.1.2

WordPress shipped 7.1.2 on September 22. It fixes one bug - CVE-2026-87902, CVSS 4.0: 9.2.

The bug is in page template resolution. WordPress builds a template filename straight from the pagename parameter in the URL and skips validate_file() for it. If the value is double URL-encoded, it gets through sanitization, and WordPress includes a PHP file from outside the theme folder. No login required.

Affected: every version from 4.7.0 to 7.1.1.

Full RCE needs two things on the server:

▎ a top-level page- directory in the active theme
▎ register_argc_argv enabled in PHP

Chances are you have both. register_argc_argv is on by default in the official PHP Docker image and in many cPanel setups on PHP < 8.5. Twenty Twelve and Twenty Fourteen ship with top-level page-* directories.

What to do

▎ Update to 7.1.2
▎ On an older branch — backports are out, including 7.0.6 and 6.9.9, and patches go back to 4.7.37

🔗 https://wordpress.org/news/2026/09/wordpress-7-1-2-release/

✅ The DDoS incident is closed.

A month ago we promised an official statement once every check was done. Here it is.

▎Infrastructure checks are complete
▎No signs of a data breach or unauthorized access were found
▎No ransom was paid

What we were up against: volumetric attacks peaking at 1.5 Tbps. That's the kind of traffic built to take down an entire network.

What we did

▎RETN helped us push back the volumetric floods
▎As the next step, part of our critical infrastructure now also sits behind Qrator Labs — protection against both large L3/L4 floods and L7 attacks, the ones that target websites and applications directly

We're not done. We keep investing in the network so AlexHost services stay available even during large, complex attacks.

Thank you to everyone who waited for this update.

— AlexHost Team

💻 Cybersecurity Awareness Month starts today, and we'll spend it on what actually takes servers down

For the next four weeks we'll take one topic at a time, in this order:

▎Week 1: DDoS.
Cloudflare blocks 128,000 attacks a day, and 90.6% are over in under 10 minutes, before anyone has time to react

▎Week 2: backups.
In 94% of ransomware attacks, criminals go after the backups, and 57% of those attempts succeed (Sophos)

▎Week 3: passwords, keys and AI.
28.65 million keys and passwords leaked to public GitHub in 2025, and 64% of the ones leaked in 2022 still work (GitGuardian)

▎Week 4: vulnerabilities.
For the first time in 19 years, they've overtaken stolen passwords as the most common way attackers break in (31% of breaches, Verizon)

▎Last post of the month: what to do in the first hour after a break-in

🧠 We'll start with a small quiz about the biggest DDoS attack Cloudflare has ever recorded. Try to answer without googling.

⚠️ We found fake accounts impersonating us

Our only official account: @alexhost_on

Scan the QR code or follow the link: t.me/alexhost_on

If a similar-looking account contacts you, check the username character by character.
If anything feels off, message us at @alexhost_on and we'll confirm.

💻 The automation works. Then it becomes your second job.

Nobody writes that part in the tutorial. A comment under one of those videos says it better than we could: "It worked. Until it became my second job. Scenarios broke silently. Only I could fix them."

We run n8n ourselves - on our own VPS boxes, until something breaks at an inconvenient hour. So here are 4 guides, in the order you'll actually need them.

▎Make vs Zapier vs n8n - what each one charges you for: tasks, credits, or executions. The meter matters more than the logo.
🔗 https://alexhost.com/faq/make-vs-zapier-vs-n8n-which-automation-platform-fits-you-best-in-2026/

▎Deploy n8n on a Debian 12 VPS - the full install, done once, done properly.
🔗 https://alexhost.com/faq/how-to-deploy-n8n-on-debian-12-vps/

▎Handling complex automation with n8n - when one workflow turns into fifteen and the retries start piling up.
🔗 https://alexhost.com/faq/handling-complex-automation-more-effectively-with-n8n/

▎n8n AI agent tutorial - from a prompt to structured workflow data you can actually route.
🔗 https://alexhost.com/faq/n8n-ai-agent-tutorial-from-simple-prompt-to-structured-workflow-data/

One honest note before you start: read the comparison first. If your workflow runs twice a day, the cloud tier is cheaper than your Saturday. Self-hosting pays off when the meter starts to hurt - not before.

📚 Everything else we've written - Linux, networking, security, web:
🔗 https://alexhost.com/faq/