Upsun is currently experiencing a minor incident affecting Grid Hosting and Grid Hosting and 1 more component, which began 4h ago. The vendor's full update timeline is below.
Affected components
Update timeline
- identified Oct 21, 2026, 09:26 AM UTC
PHP has announced a security release addressing two critical vulnerabilities, both rated CVSS v4.0 9.2. The release is scheduled for October 21, 2026, at 14:00 UTC. We are aware of and have taken action to mitigate the vulnerabilities. Further information will be released after the PHP release is published.
- identified Oct 21, 2026, 12:50 PM UTC
We're seeing an increasing number of requests matching the mitigation rules in place. As mentioned previously, all PHP sites hosted on Upsun already have an initial set of mitigations deployed for the known exploit vectors in these vulnerabilities. You don't need to do anything to get them. We'll continue to provide updates as we learn more and after the PHP release is published.
- identified Oct 21, 2026, 01:44 PM UTC
We can now confirm this Security Release is related to the recently published CVEs 2026-109618 and 2026-109619. We are in the process of rolling out updated PHP images to all upstream patched versions, which are PHP versions 8.2, 8.3, 8.4 and 8.5. As this is a critical security patch, all affected containers will be refreshed to apply the updated image. We are also rolling out additional edge mitigations to cover new vectors as they are identified. Please note that if you are currently utilising an End-of-Life PHP version lower than PHP 8.2, we strongly recommend you update to a supported version to apply the security patch.