Servd is currently experiencing a major incident, which began 7h ago. The vendor's full update timeline is below.
Update timeline
- identified Oct 21, 2026, 09:12 AM UTC
Due to the PHP critical vulnerability due to be disclosed today we have blocked all multipart upload requests on all projects and on servd.host. This will create 403 errors for image and other file uploads. We are working on restoring normal functionality, however due to the critical nature and trivial exploitation of the bug, this is the safest course of action for the time being.
- identified Oct 21, 2026, 12:50 PM UTC
We are currently waiting for PHP to release fixes which is due at 14:00 UTC. At this time we will prep them for use in Servd projects which we are expecting to take 20-30 minutes. Once these have been confirmed as effective at mitigating the issue we will release them for all projects. We will update this status page once they have been released. Once released - any new bundles created in our dashboard which are using PHP 8.2 + will contain the fix. Deploying these will automatically re-enable multipart requests for your project. This timeline may change in two scenarios: 1. PHP do not release their updates on time or it is delayed for another reason 2. The fixes within the PHP releases do not actually address the attack we have been seeing today (there has been no official confirmation that the two are related, but there is a very strong likelihood that they are the same thing).
- identified Oct 21, 2026, 01:55 PM UTC
We've received details of the vulnerability and are awaiting official patched PHP images. As soon as they're available, we'll be publishing new base bundles, and allowing customers to deploy them to their environments. In the meantime, we're shoring up our defensive edge rules based on the released info.
- identified Oct 21, 2026, 02:54 PM UTC
We're currently blocked on releasing patched PHP versions, due to delays in the release of the official PHP docker images. We'll be exporting base bundles as soon as they're made available.
- identified Oct 21, 2026, 03:48 PM UTC
The patched official PHP docker images have been published. We'll have patched PHP versions available shortly.