Ploi incident

Critical PHP vulnerabilities

Major Ongoing View vendor source →

Ploi is currently experiencing a major incident, which began 7h ago. The vendor's full update timeline is below.

Started
Oct 21, 2026, 07:32 PM UTC
Resolved
Ongoing
Duration
● 7h 3m
Detected by Pingoru
Oct 21, 2026, 07:32 PM UTC

Update timeline

  1. investigating Oct 21, 2026, 07:32 PM UTC

    Critical PHP vulnerabilities Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow remote code execution on any server that serves PHP. PHP released the fixes today in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Update your server in one of these ways: 1. Press Patch in the PHP tab of your server 2. Go to Manage → Updates and press Run now 3. Follow https://ploi.io/documentation/server/how-do-i-updateupgrade-packages-on-my-server The package builders are still catching up with demand. If your version isn't patched yet, try again later, or switch to packages.sury.org, which gets the builds first, and run the updates again: ``` wget -O php-patch.sh https://packages.sury.org/php/README.txt chmod +x php-patch.sh sudo ./php-patch.sh ``` Until then, this marketplace script turns off `session.upload_progress.enabled`. PHP lists it as a partial mitigation, not a fix: https://ploi.io/panel/marketplace/514-disable-session-upload-progress PHP 8.1 and older get no official release. Upgrade those applications to PHP 8.4 or 8.5.