Is Seravo down?

We're aware of critical PHP vulnerabilities announced at 2026-10-20. We're mitigating current known exploits, and work actively to apply security patches as soon as they are made available.

Initial mitigations have been applied to the sites. We continue to monitor the situation and apply further mitigations if needed. Security patches will be applied as soon as they're available.

As quick update: - initial mitigations have been applied to all customers, we keep monitoring the situation to apply any additional modifications if needed - we might need to temporarily restrict access to some features, we will notify about such changes separately - all PHP versions are affected - Seravo currently recommends PHP 8.3 or newer, please see https://help.seravo.com/en/articles/409537-available-php-versions for more details - upstream will provide patches at today 14:00 UTC+0, and we will start rolling out fixes as soon as update is available - upstream will provide patches for PHP 8.2 and newer versions at least initially

We're continuing in improving the mitigations and monitoring the situation. As far as we know, no current mitigation provides full protection. *Seravo will apply patches as soon as updated PHP versions will become publicly available.*

We are still working on the issue, initial mitigations in place for all customers. We expect upstream to provide patches at 17:00 (UTC+3). We've also received some questions about temporarily closing sites. Per customer request we can take site down temporarily, contact our customer service if interested ([email protected]). More on the topic: - Traficom: Kriittisiä haavoittuvuuksia PHP:ssa https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-37 (in Finnish) - YLE: Laajasti käytetyssä PHP-ohjelmointi­kielessä haavoittuvuuksia https://yle.fi/a/74-20252496 (in Finnish)

We've already been deploying the updated PHP versions for some time, due to large amount of update targets full update will take some time.

The PHP security updates are still ongoing. Thank you for your patience.

The PHP update has been applied and we're now monitoring how the situation develops.

This incident has been resolved.

We are currently investigating this issue.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

## DDoS attack at FI-Haarla On Tuesday, October 6, 2026, Seravo's server cluster FI-Haarla became a target of a large-scale DDoS attack. DDoS stands for Distributed Denial of Service, a malicious cyberattack that floods a server with overwhelming internet traffic to make it unresponsive and stop working for real users. The attack started at 9:00 \(UTC\+3\). During the attack most of the websites hosted in FI-Haarla experienced degraded service, but there was no other security threat to the sites. Visitors saw connection timeouts or HTTP502 errors when trying to visit the sites. The affected parties and relevant authorities have been informed, and no customer action is required. As part of our response, we encountered difficulties deploying the tools needed to mitigate the attack. We’ll review and improve our process to help prevent similar issues in future incidents. The attack ended at approximately 10:47, after which we continued to monitor the situation. The incident was marked as resolved on our end at 12:49. We apologize for the inconvenience caused by this attack. Seravo provides real-time updates on all disruptions at [status.seravo.com](http://status.seravo.com). We highly recommend subscribing to incident notifications via email, for example. ## Timeline \(UTC\+3\) * 09:00 DDoS starts * 09:02 DDoS detected, response initiated * 09:10 Blocks implemented * 09:31 More actions taken to mitigate the attack traffic * 10:00 Issue encountered in tooling, fixes implemented * 10:26 Tooling proves not to have the desired effect * 10:33 Further action to mitigate the attack * 10:47 Traffic suppressed, sites start recovering from DDoS

We identified a networking issue in cluster fi-ellington. Our team is working on it to fix it. We apologise for any inconvenience.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.

# Notice of a cluster outage on September 21, 2026 On Monday, September 21, 2026, we suffered from a partial outage on our server cluster FI-Ellington. The problem began at 13:15 \(UTC\+3\) and was completely resolved at 16:29. However, most of the sites remained to function until 14:20. Some sites were still needed to restart manually. The problem was related to a database service overload, affecting most of the websites hosted in the FI-Ellington cluster. The repair operations were unfortunately time-taking. Once the database service was fixed, we still needed to restart some of the site instances manually. To improve our processes for such possible issues in the future, we have implemented new tools to recover website instances faster. In addition, we have improved Seravo’s 24/7 monitoring in order to recognize issues of this type sooner. We apologize for the downtime and inconvenience caused by this incident. Seravo provides real-time updates on all disruptions at status.seravo.com. We highly recommend subscribing to incident notifications via email, for example. ## Timeline \(UTC\+3\) * 13:15 The first site alerts, investigation was started * 13:20 The issue was identified and limited to the database system * 13:25 Issue was reported on status.seravo.com * 13:50 Recovery measures * 14:20 The most sites were recovered * 14:20 Failed sites were identified and instance restarts initiated * 16:29 All sites recovered

We identified a networking issue in cluster fi-sestak. Our team is working on it to fix it. We apologise for any inconvenience.

This incident has been resolved.

## DDoS attack at FI-Sestak On Monday, September 21, 2026, Seravo's server cluster FI-Sestak became a target of a large-scale DDoS attack. DDoS stands for Distributed Denial of Service, a malicious cyberattack that floods a server with overwhelming internet traffic to make it unresponsive and stop working for real users. ‌ The attack started at 12:45 \(UTC\+3\). During the attack most of the websites hosted in FI-Sestak experienced degraded service, but there was no other security threat to the sites. Visitors received connection timeouts or HTTP502 errors while trying to visit the sites. ‌ At approximately 13:15, an incident occurred in another cluster, FI-Ellington, initially raising concerns that the incident might be related to the DDoS attack in FI-Sestak. No indication of a connection between the two incidents was found. However, the overlap temporarily diverted attention and delayed recovery of FI-Sestak. ‌ As a part of our response, we deployed new tooling to assist with mitigating an attack like this in the future. The tooling proved useful during the incident and will be retained in our toolkit for similar incidents in future. ‌ The attack ended at approximately 14:20, after which we continued to monitor the situation. The incident was marked as resolved on our end at 15:03. ‌ We apologize for the inconvenience caused by this attack. ‌ Seravo provides real-time updates on all disruptions at [status.seravo.com](http://status.seravo.com). We highly recommend subscribing to incident notifications via email, for example. ## Timeline \(UTC\+3\) * 12:45 DDoS starts * 12:49 First signs of abnormal web traffic * 12:55 First blocks deployed to mitigate the attack * 13:15 A simultaneous, unrelated issue in another server cluster slows down investigation * 13:45 New tooling deployed * 14:08 New tooling proves effective * 14:20 DDoS ends * 15:03 Incident marked as resolved

We have noticed database connectivity problems in cluster fi-sestak. We are investigating the issue.

A fix has been implemented and we are monitoring the results.

This incident has been resolved.