Outage in Scaleway
[Serverless Functions][fr-par/nl-ams/pl-waw] Security updates applied to PHP and Node.js runtimes
Resolved MinorIncident Report
Summary AI Generated
Scaleway applied emergency security patches to PHP and Node.js runtimes for Serverless Functions across all regions (fr-par, nl-ams, pl-waw) in response to two critical remote code execution vulnerabilities (CVSS 9.2) in PHP. Functions on PHP 8.2/8.3 were force-redeployed to PHP 8.4, while PHP 8.4/8.5 and Node.js 22/24/26 functions received patched runtime versions; PHP 8.2 and 8.3 are now end-of-life on the platform. The incident lasted 52 minutes and was resolved, though users managing functions via IaC (Terraform/Serverless Framework) must manually update their configurations, and Node.js users must trigger a manual redeploy to apply the patches.
We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.
---
PHP
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).
Actions taken:
- Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
- Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).
Impact for you:
- PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
- If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.
---
Node.js
Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.
If you experience any issue, please contact our support team.
We apologize for any inconvenience and thank you for your patience.
Trusted by 1,000+ teams
The Status Page Aggregator with Early Outage Detection
Stop finding out about outages from your users. Monitor 6,320+ cloud services and get alerted the second something breaks.
Latest Updates ( sorted recent to last )
RESOLVED
2 days ago - at 10/22/2026 04:10PM
This incident has been resolved.
MONITORING
2 days ago - at 10/22/2026 03:28PM
A fix has been implemented and we are monitoring the results.
INVESTIGATING
2 days ago - at 10/22/2026 03:18PM
We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.
---
PHP
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).
Actions taken:
- Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
- Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).
Impact for you:
- PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
- If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.
---
Node.js
Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.
If you experience any issue, please contact our support team.
We apologize for any inconvenience and thank you for your patience.
Latest Scaleway outages
P3 - [INSTANCES] - it-mil-1 - Instance APIs down - 3 days ago
The Status Page Aggregator with Early Outage Detection
With IsDown, you can monitor all your critical services' official status pages from one centralized dashboard and receive instant alerts the moment an outage is detected. Say goodbye to constantly checking multiple sites for updates and stay ahead of outages with IsDown.
Start free trialNo credit card required · Cancel anytime · 6320 services available
Integrations with
