Back to overview
Resolved

US/EU urgent PHP security update

Oct 21, 2026 at 2:00pm UTC  –  Oct 21, 2026 at 8:04pm UTC
Affected services
US Pro Apps
US Universal Apps
US Deployment
EU Pro Apps
EU Universal Apps
EU Deployment

Resolved
Oct 21, 2026 at 8:04pm UTC

Maintenance ended

Updated
Oct 21, 2026 at 8:04pm UTC

This security maintenance is finished. All PHP versions on the old platform now include the fix for CVE-2026-109618 and CVE-2026-109619.

8.4.27, 8.3.36, 8.2.35: official fixed releases
8.1.34, 8.0.30, 7.4.33: end-of-life versions, rebuilt with the PHP security team’s official backport of these two fixes.

Thank you for your patience.

Updated
Oct 21, 2026 at 7:44pm UTC

The dashboard is back again. The rest of the maintenance is still ongoing.

Updated
Oct 21, 2026 at 3:22pm UTC

The maintenance is under way. Building the patched PHP versions takes longer than planned, because the package servers we download from are overloaded right now. Expect a few more hours.

  • The dashboards of both platforms are offline for now.
  • A temporary PHP config change is in place on all apps of both platforms. It blocks the easiest attack path, but not all of them: apps stay vulnerable until the patched PHP is rolled out.

We don't plan to take customer websites offline for now. We keep monitoring.

To take your website offline yourself until it is patched, add this at the top of the .htaccess in your web root:

# offline
Order deny,allow
Deny from all

Remove the lines to go back online. A maintenance mode inside your app, like "artisan down", doesn't protect you: PHP still parses the request.

Created
Oct 21, 2026 at 2:00pm UTC

There's an urgent security upgrade for PHP that needs to be applied immediately. Your app will be down for up to 20 minutes during this maintenance. We cannot tell you exactly when your app will be down, just that it will be down at some point during the maintenance window.

Security patch announcement: https://www.php.net/archive/2026.php#2026-10-20-1