Critical PHP vulnerabilities

Update timeline

1. identified Oct 21, 2026, 07:35 AM UTC

   We're aware of critical PHP vulnerabilities announced at 2026-10-20. We're mitigating current known exploits, and work actively to apply security patches as soon as they are made available.

2. identified Oct 21, 2026, 08:19 AM UTC

   Initial mitigations have been applied to the sites. We continue to monitor the situation and apply further mitigations if needed. Security patches will be applied as soon as they're available.

3. identified Oct 21, 2026, 08:22 AM UTC

   As quick update: - initial mitigations have been applied to all customers, we keep monitoring the situation to apply any additional modifications if needed - we might need to temporarily restrict access to some features, we will notify about such changes separately - all PHP versions are affected - Seravo currently recommends PHP 8.3 or newer, please see https://help.seravo.com/en/articles/409537-available-php-versions for more details - upstream will provide patches at today 14:00 UTC+0, and we will start rolling out fixes as soon as update is available - upstream will provide patches for PHP 8.2 and newer versions at least initially

4. identified Oct 21, 2026, 09:18 AM UTC

   We're continuing in improving the mitigations and monitoring the situation. As far as we know, no current mitigation provides full protection. *Seravo will apply patches as soon as updated PHP versions will become publicly available.*

5. identified Oct 21, 2026, 11:01 AM UTC

   We are still working on the issue, initial mitigations in place for all customers. We expect upstream to provide patches at 17:00 (UTC+3). We've also received some questions about temporarily closing sites. Per customer request we can take site down temporarily, contact our customer service if interested ([email protected]). More on the topic: - Traficom: Kriittisiä haavoittuvuuksia PHP:ssa https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-37 (in Finnish) - YLE: Laajasti käytetyssä PHP-ohjelmointi­kielessä haavoittuvuuksia https://yle.fi/a/74-20252496 (in Finnish)

6. identified Oct 21, 2026, 02:23 PM UTC

   We've already been deploying the updated PHP versions for some time, due to large amount of update targets full update will take some time.

7. identified Oct 21, 2026, 04:40 PM UTC

   The PHP security updates are still ongoing. Thank you for your patience.

8. monitoring Oct 21, 2026, 09:34 PM UTC

   The PHP update has been applied and we're now monitoring how the situation develops.

9. resolved Oct 22, 2026, 05:48 AM UTC

   This incident has been resolved.