Critical PHP vulnerabilities

This incident has been resolved.

The PHP update has been applied and we're now monitoring how the situation develops.

The PHP security updates are still ongoing.

Thank you for your patience.

We've already been deploying the updated PHP versions for some time, due to large amount of update targets full update will take some time.

We are still working on the issue, initial mitigations in place for all customers. We expect upstream to provide patches at 17:00 (UTC+3).

We've also received some questions about temporarily closing sites. Per customer request we can take site down temporarily, contact our customer service if interested (help@seravo.com).


More on the topic:

- Traficom: Kriittisiä haavoittuvuuksia PHP:ssa https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-37 (in Finnish)
- YLE: Laajasti käytetyssä PHP-ohjelmointi­kielessä haavoittuvuuksia https://yle.fi/a/74-20252496 (in Finnish)

We're continuing in improving the mitigations and monitoring the situation. As far as we know, no current mitigation provides full protection.

*Seravo will apply patches as soon as updated PHP versions will become publicly available.*

As quick update:

- initial mitigations have been applied to all customers, we keep monitoring the situation to apply any additional modifications if needed
- we might need to temporarily restrict access to some features, we will notify about such changes separately
- all PHP versions are affected
- Seravo currently recommends PHP 8.3 or newer, please see https://help.seravo.com/en/articles/409537-available-php-versions for more details
- upstream will provide patches at today 14:00 UTC+0, and we will start rolling out fixes as soon as update is available
- upstream will provide patches for PHP 8.2 and newer versions at least initially

Initial mitigations have been applied to the sites. We continue to monitor the situation and apply further mitigations if needed.

Security patches will be applied as soon as they're available.

We're aware of critical PHP vulnerabilities announced at 2026-10-20. We're mitigating current known exploits, and work actively to apply security patches as soon as they are made available.