All updates have now been applied across our platform, including patches and mitigations for end-of-life PHP versions (on a best effort basis).
Applications temporarily taken offline at customer requests have been brought back online, and the affected customers have been notified.
We are monitoring the remaining open items and will provide a further update once these have been addressed.
Posted Oct 21, 2026 - 22:22 CEST
Update
The rollout of the official patches to all supported PHP versions (8.2 through 8.5) has been completed.
We are now focusing on the two remaining steps: lifting the temporary restrictions, and rolling out backported security patches to the remaining end-of-life PHP versions.
We will post another update once the rollout to the end-of-life versions is complete.
Posted Oct 21, 2026 - 19:08 CEST
Update
Due to the PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), our phone lines will remain open for extended hours to assist customers.
Patching is still ongoing across our platform. Now that the patches are rolling out on the supported PHP versions, we are starting to gradually lift the temporary restrictions applied earlier, and we are also beginning to roll out fixes to older PHP versions.
We will post another update once the rollout has been completed. Thank you for your patience.
Posted Oct 21, 2026 - 18:07 CEST
Update
Updated container images with the security patches are now available for PHP 8.2, 8.3, 8.4 and 8.5.
If you run your own containers on our Managed Apps platform, based on our PHP images, we recommend pulling the latest images and redeploying as soon as possible. The rollout across the rest of our platform is still in progress, and we will post another update once it has been completed.
Posted Oct 21, 2026 - 16:15 CEST
Update
The official PHP security patches have now been released. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that can allow unauthenticated remote code execution.
We are currently rolling out these patches across all supported PHP versions on our platform. The rollout is in progress as we speak, and we will update this notice once it has been completed.
The mitigations we applied earlier today, including disabling the PHP session upload progress feature (session.upload_progress.enabled), remain in place during the rollout.
No action is required on your side. If you have any questions or concerns, please do not hesitate to contact our support team. Please note that response times may still be longer than usual due to the high volume of requests.
Posted Oct 21, 2026 - 15:58 CEST
Update
We are currently receiving a high volume of requests from customers asking us to temporarily take down their environments and websites as a precautionary measure in response to the recently announced PHP vulnerability. We are prioritising these requests to ensure they are handled as quickly as possible. As a result, response times for other support tickets may be longer than usual.
We apologise for any inconvenience this may cause and appreciate your patience and understanding while our team works through these requests. We will continue to provide updates as the situation develops.
Posted Oct 21, 2026 - 14:41 CEST
Update
We have now applied mitigations across our platform to reduce the risk of exploitation of the recently announced PHP vulnerability. This includes disabling the legacy PHP session upload progress feature (session.upload_progress.enabled).
Regular file uploads remain unaffected. Only custom applications relying on this feature for upload progress reporting may notice a difference.
Official PHP security patches are expected today at 16:00 CEST. We will roll these out across supported PHP versions as soon as they become available.
No action is required on your side. We will provide another update once the patches have been deployed. If you have any questions or concerns, please do not hesitate to contact our support team.
Posted Oct 21, 2026 - 09:31 CEST
Investigating
We are aware of a recently announced remote code execution (RCE) vulnerability in PHP. Official details and patches for supported PHP versions are expected to be published today at 16:00. We will roll out these patches as soon as they are available.
Some details of the vulnerability have already leaked ahead of the official release. Based on this information, we are deploying mitigations on our platform right now to reduce the risk of exploitation before the official patches arrive.
As part of these mitigations, we are disabling the PHP session upload progress feature (session.upload_progress.enabled). This is a rarely used, legacy feature that lets a script report the progress of a file upload through the PHP session. File uploads themselves are not affected, and no major frameworks or CMS platforms depend on this feature. The only visible effect would be on custom applications that use it to display an upload progress bar, which may no longer update. If your application relies on this feature, we recommend updating it to use an alternative method for progress reporting or contact our support team.
No action is required on your side at this time. We will update this notice as soon as more information becomes available.
Posted Oct 21, 2026 - 08:21 CEST
This incident affected: Managed Servers (Compute) and Managed Apps (Managed Apps).