Resolved after 13 hours 58 minutes, affecting Servebolt Cloud OSL and Servebolt Cloud AMS and 1 more, on October 21, 2026.
The temporary mitigations have been removed and the incident is now considered fully resolved.
Affected components
Update timeline
- monitoring Oct 21, 2026, 08:58 AM UTC
We are aware of a major PHP security issue without a published upstream fix. Curently known mitigations have been enabled and the full patch will be deployed as soon as it is available.
- monitoring Oct 21, 2026, 02:58 PM UTC
The PHP development team has released security updates addressing the two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities affect PHP's internal memory and request handling and could potentially allow unauthenticated attackers to execute code on affected servers. The security fixes are included in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. We have already implemented temporary security mitigations to reduce exposure and are now actively rolling out the patched PHP versions across the Servebolt infrastructure. Our engineering team is closely monitoring the deployment and will provide further updates as the rollout progresses.
- monitoring Oct 21, 2026, 04:31 PM UTC
PHP security updates have been deployed for PHP versions 8.2 to 8.5. We are still working to get fixes out for customers on legacy versions.
- monitoring Oct 21, 2026, 09:10 PM UTC
The PHP security updates have now been deployed for PHP versions 7.3 to 8.1 as well. Some mitigations/restrictions will remain in place until it has been fully validated.
- resolved Oct 21, 2026, 10:56 PM UTC
The temporary mitigations have been removed and the incident is now considered fully resolved.
Your product runs on more than Servebolt
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services