Ongoing since 03:25 PM UTC, affecting Virtuozzo PaaS and Application Monitoring (Application Monitoring — STO1 - Stockholm South) and 1 more.
We now have information that MySQL, LiteSpeed and LLSMP has updated images in the platform. When verifying availability of the announced images we notice that also LEMP seem to have a patched image available. As mentioned we do not get live updates regarding the patches. Customers still waiting for patched images should keep an eye out for them, as they might arrive before we get the possibility to share information about their availability.
Affected components
Update timeline
- identified Oct 21, 2026, 03:25 PM UTC
Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) allow unauthenticated remote code execution. Fixed PHP versions are out, and we are waiting for our supplier to release updated images so we can patch the platform. There is currently no indication that our platform has been compromised, but stopping your environment is the only way to be certain. If you run your own PHP, we strongly recommend upgrading to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. We will post an update by 21:00 CEST at the latest, but hope to have it patched by then.
- identified Oct 21, 2026, 07:11 PM UTC
We are still waiting for our supplier to release updated images, so the platform is not yet patched. Next update will be tomorrow at 08:30 CEST.
- identified Oct 22, 2026, 06:35 AM UTC
The supplier has issued new images for most of the affected versions. We urge our customers to swiftly update your environment using the available patched images. Remaining images are being worked on.
- identified Oct 22, 2026, 09:10 AM UTC
Regarding remaining patches the latest information we have from supplier is: LiteSpeed: Targeting publication by EOD today (EEST, UTC+3). Database templates: Estimated 1-2 days due to longer testing cycles. Unfortunately we do not get live updates regarding these patches and urge customers to keep an eye out for patched images, as they might arrive before we get the possibility to share information about their availability.
- identified Oct 22, 2026, 08:23 PM UTC
We now have information that MySQL, LiteSpeed and LLSMP has updated images in the platform. When verifying availability of the announced images we notice that also LEMP seem to have a patched image available. As mentioned we do not get live updates regarding the patches. Customers still waiting for patched images should keep an eye out for them, as they might arrive before we get the possibility to share information about their availability.
Your product runs on more than Elastx
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services