Outage in Kinsta
PHP Security Vulnerability Update
Resolved MinorIncident Report
Summary AI Generated
Kinsta responded to a PHP security vulnerability affecting all platform-hosted sites over approximately 13 hours, with MyKinsta identified as the affected component. Throughout the incident, attacks were actively blocked via Cloudflare firewall rules and local configuration changes, while patched PHP versions (7.4, 8.0–8.5) were validated and rolled out in stages across the infrastructure. The incident was resolved with all PHP versions patched platform-wide and no evidence of any breaches related to the vulnerability.
We're actively addressing the PHP security vulnerability announced by the PHP security team. As PHP is managed at the platform level on Kinsta, fixes will be deployed automatically once validated.
We do want to clarify that the attacks are being successfully mitigated by our Cloudflare site protections, across all our sites, based on rules created specifically for these vulnerabilities. We continue to maintain multiple comprehensive levels of security to mitigate any potential attacks.
The patched versions of PHP 8.3 and 8.5 have now been validated and are being rolled out across our platform. If your site is already using either version and you'd like to apply the patch immediately, you can switch to a lower PHP version and then back to your original version.
Updates for PHP 8.4, 8.2, 8.1, and 7.4 are still undergoing validation and will be rolled out once ready. No action is required on your end.
We'll provide further updates as the rollout progresses.
Components affected
Kinsta MyTrusted by 1,000+ teams
The Status Page Aggregator with Early Outage Detection
Stop finding out about outages from your users. Monitor 6,320+ cloud services and get alerted the second something breaks.
Latest Updates ( sorted recent to last )
RESOLVED
3 days ago - at 10/22/2026 08:26AM
All sites are protected, the PHP security updates have been rolled out across the platform, and we have no evidence of any breaches related to this vulnerability.
INVESTIGATING
3 days ago - at 10/22/2026 01:31AM
The following PHP versions have patches that are rolling out across our infrastructure: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5
Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
INVESTIGATING
3 days ago - at 10/21/2026 11:25PM
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.1, 8.0, 7.4, 8.2, and 8.4.
Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
INVESTIGATING
3 days ago - at 10/21/2026 10:06PM
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.1, 8.0, and 7.4
The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4 and 8.2
Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
INVESTIGATING
3 days ago - at 10/21/2026 09:17PM
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.0, and 7.4
The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4, 8.2, and 8.1
Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
INVESTIGATING
4 days ago - at 10/21/2026 08:20PM
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, and 8.0
The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4, 8.2, 8.1, and 7.4
Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
INVESTIGATING
4 days ago - at 10/21/2026 07:04PM
We're actively addressing the PHP security vulnerability announced by the PHP security team. As PHP is managed at the platform level on Kinsta, fixes will be deployed automatically once validated.
We do want to clarify that the attacks are being successfully mitigated by our Cloudflare site protections, across all our sites, based on rules created specifically for these vulnerabilities. We continue to maintain multiple comprehensive levels of security to mitigate any potential attacks.
The patched versions of PHP 8.3 and 8.5 have now been validated and are being rolled out across our platform. If your site is already using either version and you'd like to apply the patch immediately, you can switch to a lower PHP version and then back to your original version.
Updates for PHP 8.4, 8.2, 8.1, and 7.4 are still undergoing validation and will be rolled out once ready. No action is required on your end.
We'll provide further updates as the rollout progresses.
Latest Kinsta outages
Information in regards to newly discovered PHP vulnerability CVE-2026-115560 (Oct 23, 2026) - 2 days ago
Partial outage in London datacenter - 5 days ago
Service disruption at the Toronto (CA) data center - about 2 months ago
MyKinsta performance degradation - about 2 months ago
The Status Page Aggregator with Early Outage Detection
With IsDown, you can monitor all your critical services' official status pages from one centralized dashboard and receive instant alerts the moment an outage is detected. Say goodbye to constantly checking multiple sites for updates and stay ahead of outages with IsDown.
Start free trialNo credit card required · Cancel anytime · 6320 services available
Integrations with
