Sucuri incident

PHP Security Advisory: Critical remote code execution vulnerabilities

Notice Vendor's status page →

Ongoing since 03:14 PM UTC, affecting North America West and North America Central and 1 more.

monitoring Oct 21, 2026, 03:14 PM UTC

Sucuri has deployed additional Web Application Firewall (WAF) rules to help mitigate attack patterns associated with the recently disclosed critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. We are monitoring these protections and related traffic. These rules provide an additional layer of protection for traffic passing through the Sucuri Website Firewall. WAF protection does not replace patching PHP on your origin server. We strongly recommend contacting your hosting provider or server administrator to apply the appropriate PHP security update as soon as possible. The PHP Development Team has released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Your operating system or hosting vendor may also provide patched packages. Please review the official PHP security advisory for remediation guidance. https://www.php.net/archive/2026.php#2026-10-21-5

Other major vendors with incidents starting within 30 minutes

GitHub Outage Delays for Pull Requests and Webhook deliveries Asana Outage Asana downtime Supabase Outage Project lifecycle operations such as project creation, pausing, and restoration, in all regions Twilio Degraded Customer's Unable to Create New Requests for Hosting and Porting Zapier Degraded Delayed real-time updates in Zapier Tables OpenAI Degraded Elevated error rates for gpt-5.6-luna API requests

Your product runs on more than Sucuri

Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.

Cloudflare Amazon Web Services Twilio Stripe Slack Okta Figma GitHub Datadog Vercel OpenAI Google Cloud

Add your stack →