Stova incident

PHP Security Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

Resolved after 7 hours 33 minutes, on October 21, 2026.

resolved Oct 21, 2026, 10:42 PM UTC

The PHP 8.4.27 upgrade has been released to all Stova servers, resolving the issue of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

Other major vendors with incidents that started within 30 minutes of this one

GitHub Outage Delays for Pull Requests and Webhook deliveries

Zapier Outage Delayed real-time updates in Zapier Tables

Supabase Outage Project lifecycle operations such as project creation, pausing, and restoration, in all regions

Zoom Degraded Service Degradation Affecting Zoom Learning Webpage

Twilio Degraded Customer's Unable to Create New Requests for Hosting and Porting

OpenAI Degraded Elevated error rates for gpt-5.6-luna API requests

Started: Oct 21, 2026, 03:08 PM UTC
Resolved: Oct 21, 2026, 10:42 PM UTC
Duration: 7h 33m
Detected by Pingoru: Oct 21, 2026, 03:08 PM UTC

Update timeline

identified Oct 21, 2026, 03:08 PM UTC

We are aware of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed today. PHP is in use on our platform, and our Security and DevOps teams are actively working on this. We are testing the recommended PHP configuration change as a temporary protection until the fix is in place. The official PHP security release is expected at 14:00 UTC today. Once released, the fix will be tested before being deployed to production. We will post updates here as each step is completed.
resolved Oct 21, 2026, 10:42 PM UTC

The PHP 8.4.27 upgrade has been released to all Stova servers, resolving the issue of two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

Your product runs on more than Stova

Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.