Is Cloudways down?

We are aware of the reports highlighting regressions in a few of the recent official PHP security patches. The official PHP Group has not yet published an official position or updated patches addressing these reports. Mitigations remain in place to protect customers against the currently known attack paths, and we continue to monitor for further developments. No action is required from customers at this time. The currently known regressions are: 1. Configuration-dependent RCE: A reported RCE demonstration affects PHP 8.5.12 (which may possibly affect earlier versions as well) under specific configurations. We have implemented mitigations that break the demonstrated exploit chain. Our customers remain protected against this specific attack path. 2. Memory-safety Regression: A separate, verified bug report identifies a potential double-free issue affecting PHP 8.4.27 and 8.5.12, which may cause crashes under specific conditions. This is currently a stability and memory-safety concern, not a critical security issue (e.g., remote code execution). We are monitoring the situation and will continue to respond quickly to new vulnerability details or attack techniques as they emerge. If you have any questions, please reach out to our support team.

PHP RCE Advisory (CVE-2026-115560) Following the PHP Group’s latest security advisory (https://www.php.net/archive/2026.php#2026-10-23-1), the configuration-dependent remote code execution (RCE) issue highlighted in our previous update has now been assigned CVE-2026-115560. As reflected in our previous update, our Security team had proactively anticipated this vulnerability and implemented mitigations before the vulnerability was formally disclosed. The mitigations already in place align with the recommendations in the PHP Group’s latest advisory. Customers continue to be protected against the new CVE-2026-115560. No action is required from customers at this time. We continue to monitor developments and will adapt our protections as needed.

This incident has been resolved.

Cloudways Security is closely monitoring the situation and implementing interim mitigations to strengthen the security of affected PHP environments while awaiting the release of official patches from the PHP Group. The PHP Group has announced that patch releases are expected to begin on 21 October 2026 at 14:00 UTC, with availability varying by PHP version. For deprecated PHP versions, Cloudways is leveraging its Extended Long Term Support (ELTS) partnerships to help maintain security coverage and address vulnerabilities where official patches may not be available. Customers will receive further updates via email, and this status page will be updated as new information becomes available.

Today, the PHP Group disclosed critical Remote Code Execution (RCE) vulnerabilities affecting PHP. Because PHP powers a significant share of the web, including WordPress, Drupal, Laravel, and custom applications, we notified all customers this morning. To follow up on our previous notice on status.cloudways.com, we are implementing further latest interim configuration-level mitigations recommended by the PHP Group while preparing for a phased rollout of the official patches across our fleet. These interim measures provide an additional layer of protection while patch deployment is underway. For deprecated PHP versions, we are working with our ELTS partners to apply the appropriate security patches and maintain security coverage.

To follow up on our previous notice, interim configuration-level mitigations recommended by the official PHP Group have been deployed across the fleet. The phased rollout of official security patches is currently in progress, with these interim measures providing an additional layer of protection while patch deployment continues toward completion across the entire fleet. We are applying security patches across all Cloudways-supported PHP versions, including deprecated versions, covering PHP 5.6 and above. The rollout is currently in progress and includes PHP 5.6, 7.4, 8.0, 8.1, 8.2, 8.3, and 8.4, using the corresponding security patches for each version. This maintenance activity does not impact the availability or operation of Cloudways Platform, customer websites, or Affiliate Portal services.

We have applied security patches for all customer applications hosted on Autonomous. In parallel, we continue to rollout patches for applications hosted on Flexible.

The PHP security patch is being deployed to customer applications hosted on Flexible. Rollout is in progress and proceeding on schedule across all remaining instances. No action is needed from the customers. We will share a final update once the activity is completed. Our interim protections remains in place for all sites until the deployment is complete.

The PHP security patch rollout is in its final stage, with the majority of servers now patched. Our team is completing the remaining instances and we expect all patching to be completed by 09:00 UTC. Interim protections remain in place until then and no action is needed from the customers.

The PHP security patch rollout is complete, and all active servers have been successfully updated. Our support team is proactively reaching out to a small subset of customers whose environments require additional assistance. If you have any questions. please reach out to our support team.

The PHP security patch rollout is complete, and all active servers have been successfully updated. Our support team is proactively reaching out to a small subset of customers whose environments require additional assistance. If you have any questions, please reach out to our support team.

We are continuing to monitor for any further issues.

This incident has been resolved.

Some Cloudways Autonomous applications hosted in the London region may be experiencing temporary connectivity issues due to a partial disruption. Our team is actively working with the infrastructure provider to restore full stability as quickly as possible.

The issue has been identified as originating from our upstream provider in the London region. We are in close coordination with their team as they work on a resolution. We will provide further updates here as more information becomes available. We apologize for any inconvenience caused.

We apologize for the inconvenience. The issue has been resolved. If you continue to experience any related issues, please contact our support team

We are currently aware of an issue affecting Rackspace email services. Users may experience difficulty logging into their email accounts via the webmail portal or third-party email clients, as well as errors when creating new mailboxes. The Rackspace team has identified the root cause and is actively working on a resolution. We are closely monitoring the situation and will provide further updates as new information becomes available. We apologize for any inconvenience caused.

We have confirmed that the upstream Rackspace email service issue has been fully resolved. All services, including webmail portal logins, third-party email clients, and mailbox creation, are now functioning normally. Thank you for your patience during this time.

We are currently investigating an issue impacting upstream API requests to Vultr. As a result, server management operations involving Vultr instances including launching new servers, cloning existing servers, and executing reboots may time out or fail. Active, running Vultr servers and hosted applications are unaffected and operating normally, as only administrative management actions are impacted. Our team is actively monitoring the upstream response, and we will provide another update as soon as more information becomes available.

We have confirmed that the upstream Vultr API performance degradation has been fully resolved. All server management operations including launching new instances, cloning existing servers, and executing reboots are now fully restored and functioning normally. Thank you for your patience while we monitored the resolution.