20i experienced a minor incident on October 21, 2026 affecting 20i hosting platform, lasting 5h 37m. The incident has been resolved; the full update timeline is below.
Affected components
Update timeline
- investigating Oct 21, 2026, 02:24 PM UTC
We are aware of the recently disclosed PHP security vulnerabilities, commonly referred to as PHP2Shell. As a precaution, we have already implemented additional security measures across our hosting platform. Our systems team is now working on deploying the latest PHP security patches across our hosting platform, including backporting the necessary fixes where required. We will continue to monitor the situation closely and provide a further update once the rollout is complete.
- investigating Oct 21, 2026, 04:37 PM UTC
Our system administration team have applied the upstream patches and have started to deploy the latest PHP Versions across our platforms.
- investigating Oct 21, 2026, 05:30 PM UTC
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are now available and the upstream security fixes have also been backported to all older PHP versions. The roll out to our hosting platform has completed. Cloud Servers are in progress.
- investigating Oct 21, 2026, 06:51 PM UTC
All Cloud Servers have now received PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The backported PHP versions are rolling out to cloud servers now.
- investigating Oct 21, 2026, 08:01 PM UTC
All Cloud Servers have now been successfully updated. This completes our deployment and all PHP versions across all platforms are now fully patched against the recently disclosed PHP vulnerabilities.