Open Source Lab incident
Critical PHP security release (Oct 21)
Open Source Lab is currently experiencing a critical incident affecting Internal Monitoring and Internal Monitoring (Internal Monitoring — Salem, OR), which began 8h ago. The vendor's full update timeline is below.
Affected components
Update timeline
- identified Oct 21, 2026, 05:22 AM UTC
PHP has announced two critical security vulnerabilities and will publish fixed releases on Wednesday, Oct 21 at 7:00 AM PDT (14:00 UTC). If your project runs PHP on a VM or server that you manage yourself, please update PHP as soon as your package source has the fix, and restart PHP-FPM or your web server afterwards. Who needs to act: - Projects that manage their own OpenStack VMs or colocated servers and run PHP (for example WordPress, Drupal, MediaWiki, Nextcloud, phpBB or DokuWiki). - Hosts that OSL manages for you: we are patching these ourselves today, and we will contact you directly if your site needs application changes. What PHP has said: PHP rates both flaws critical (CVSS 9.2) and has not yet published which components are affected. Security researchers believe they allow remote code execution and affect PHP 5 through 8. Fixes will ship only for the supported branches 8.2, 8.3, 8.4 and 8.5. PHP 8.1 and older are end-of-life and will not get an official fix. What to do: - PHP 8.2 or newer: install your vendor's update when it appears (Remi, Ubuntu or Debian security updates, or a rebuilt Docker image), then restart PHP-FPM or the web server. - PHP 8.1 or older: plan a move to PHP 8.3 or 8.4 now. PHP 8.2's security support also ends on Dec 31, 2026. Remi's repository has backported security fixes to 7.4, 8.0 and 8.1 on a best-effort basis in the past, which can serve as a stopgap. - An end-of-life OS (CentOS 7, Ubuntu 20.04 without Ubuntu Pro, Debian 11): no free fix is expected, so please plan an OS upgrade. If you are unsure whether you are affected or need help, email [email protected].