Cloudways incident
Critical PHP Remote Code Execution Vulnerabilities - Monitoring & Mitigations Underway
Cloudways is currently experiencing a critical incident affecting Cloudways Cloud Platform Console and Cloudways Cloud Platform Service, which began 16h ago. The vendor's full update timeline is below.
Affected components
Update timeline
- identified Oct 21, 2026, 09:16 AM UTC
Cloudways Security is closely monitoring the situation and implementing interim mitigations to strengthen the security of affected PHP environments while awaiting the release of official patches from the PHP Group. The PHP Group has announced that patch releases are expected to begin on 21 October 2026 at 14:00 UTC, with availability varying by PHP version. For deprecated PHP versions, Cloudways is leveraging its Extended Long Term Support (ELTS) partnerships to help maintain security coverage and address vulnerabilities where official patches may not be available. Customers will receive further updates via email, and this status page will be updated as new information becomes available.
- identified Oct 21, 2026, 04:43 PM UTC
Today, the PHP Group disclosed critical Remote Code Execution (RCE) vulnerabilities affecting PHP. Because PHP powers a significant share of the web, including WordPress, Drupal, Laravel, and custom applications, we notified all customers this morning. To follow up on our previous notice on status.cloudways.com, we are implementing further latest interim configuration-level mitigations recommended by the PHP Group while preparing for a phased rollout of the official patches across our fleet. These interim measures provide an additional layer of protection while patch deployment is underway. For deprecated PHP versions, we are working with our ELTS partners to apply the appropriate security patches and maintain security coverage.
- identified Oct 21, 2026, 10:19 PM UTC
To follow up on our previous notice, interim configuration-level mitigations recommended by the official PHP Group have been deployed across the fleet. The phased rollout of official security patches is currently in progress, with these interim measures providing an additional layer of protection while patch deployment continues toward completion across the entire fleet. We are applying security patches across all Cloudways-supported PHP versions, including deprecated versions, covering PHP 5.6 and above. The rollout is currently in progress and includes PHP 5.6, 7.4, 8.0, 8.1, 8.2, 8.3, and 8.4, using the corresponding security patches for each version. This maintenance activity does not impact the availability or operation of Cloudways Platform, customer websites, or Affiliate Portal services.
- monitoring Oct 22, 2026, 01:02 AM UTC
We have applied security patches for all customer applications hosted on Autonomous. In parallel, we continue to rollout patches for applications hosted on Flexible.