Ongoing since 03:14 PM UTC.
PHP on servers managed by us (Managed OS) are now up to date. [Link to Progress](https://docs.google.com/spreadsheets/d/1IO_mtDMKx8_ZHlfNBn_Org5TVUQD0MdDW07UByNnt8c/)
Other major vendors with incidents starting within 30 minutes
Update timeline
- identified Oct 21, 2026, 03:14 PM UTC
On 21 October 2026, the PHP project published security updates for two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). They can allow remote code execution. Affected for you: PHP on servers managed by us (Managed OS) and PHP apps on Deploio (PHP buildpack and Dockerfile). What we are doing: our engineers are reviewing the updates and will apply them for the systems we manage already. For Deploio, we depend on the updated buildpack and upstream images which are currently being released. Customers with self-managed PHP installations or a pinned PHP version in their Dockerfile need to update themselves. The current patch status per OS and PHP version is tracked here and updated continuously: [Link to Progress](https://docs.google.com/spreadsheets/d/1IO_mtDMKx8_ZHlfNBn_Org5TVUQD0MdDW07UByNnt8c/) We will post the next update here as soon as there is progress.
- identified Oct 21, 2026, 09:43 PM UTC
PHP on servers managed by us (Managed OS) are now up to date. [Link to Progress](https://docs.google.com/spreadsheets/d/1IO_mtDMKx8_ZHlfNBn_Org5TVUQD0MdDW07UByNnt8c/)
Your product runs on more than nine
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services