Critical PHP Remote Code Execution Vulnerabilities - Monitoring & Mitigations Underway

This incident has been resolved.

We are continuing to monitor for any further issues.

The PHP security patch rollout is complete, and all active servers have been successfully updated. Our support team is proactively reaching out to a small subset of customers whose environments require additional assistance.

If you have any questions, please reach out to our support team.

The PHP security patch rollout is complete, and all active servers have been successfully updated. Our support team is proactively reaching out to a small subset of customers whose environments require additional assistance.

If you have any questions. please reach out to our support team.

The PHP security patch rollout is in its final stage, with the majority of servers now patched. Our team is completing the remaining instances and we expect all patching to be completed by 09:00 UTC.

Interim protections remain in place until then and no action is needed from the customers.

The PHP security patch is being deployed to customer applications hosted on Flexible. Rollout is in progress and proceeding on schedule across all remaining instances. No action is needed from the customers. We will share a final update once the activity is completed.

Our interim protections remains in place for all sites until the deployment is complete.

We have applied security patches for all customer applications hosted on Autonomous. In parallel, we continue to rollout patches for applications hosted on Flexible.

To follow up on our previous notice, interim configuration-level mitigations recommended by the official PHP Group have been deployed across the fleet. The phased rollout of official security patches is currently in progress, with these interim measures providing an additional layer of protection while patch deployment continues toward completion across the entire fleet.

We are applying security patches across all Cloudways-supported PHP versions, including deprecated versions, covering PHP 5.6 and above. The rollout is currently in progress and includes PHP 5.6, 7.4, 8.0, 8.1, 8.2, 8.3, and 8.4, using the corresponding security patches for each version.

This maintenance activity does not impact the availability or operation of Cloudways Platform, customer websites, or Affiliate Portal services.

Today, the PHP Group disclosed critical Remote Code Execution (RCE) vulnerabilities affecting PHP. Because PHP powers a significant share of the web, including WordPress, Drupal, Laravel, and custom applications, we notified all customers this morning.

To follow up on our previous notice on status.cloudways.com, we are implementing further latest interim configuration-level mitigations recommended by the PHP Group while preparing for a phased rollout of the official patches across our fleet. These interim measures provide an additional layer of protection while patch deployment is underway.

For deprecated PHP versions, we are working with our ELTS partners to apply the appropriate security patches and maintain security coverage.

Cloudways Security is closely monitoring the situation and implementing interim mitigations (that may cause a short service disruption) to strengthen the security of affected PHP environments while awaiting the release of official patches from the PHP Group. The PHP Group has announced that patch releases are expected to begin on 21 October 2026 at 14:00 UTC, with availability varying by PHP version.

For deprecated PHP versions, Cloudways is leveraging its Extended Long Term Support (ELTS) partnerships to help maintain security coverage and address vulnerabilities where official patches may not be available.

Customers will receive further updates via email, and this status page will be updated as new information becomes available.