Ongoing since 02:38 PM UTC, affecting Hosting and Web Hosting.
The PHP project released today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5 As a precaution, we have taken Webhosting websites offline while we apply the patched PHP versions. Our team is actively working to patch and restore the service as soon as possible.
Affected components
Update timeline
- identified Oct 21, 2026, 02:38 PM UTC
The PHP project released today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5 As a precaution, we have taken Webhosting websites offline while we apply the patched PHP versions. Our team is actively working to patch and restore the service as soon as possible.
Your product runs on more than Scaleway
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services