Outage in Sucuri
PHP Security Advisory: Critical remote code execution vulnerabilities
Minor
October 21, 2026 - Started 6 days ago
Official incident page
Official incident page
Incident Report
Sucuri has deployed additional Web Application Firewall (WAF) rules to help mitigate attack patterns associated with the recently disclosed critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. We are monitoring these protections and related traffic.
These rules provide an additional layer of protection for traffic passing through the Sucuri Website Firewall. WAF protection does not replace patching PHP on your origin server.
We strongly recommend contacting your hosting provider or server administrator to apply the appropriate PHP security update as soon as possible. The PHP Development Team has released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Your operating system or hosting vendor may also provide patched packages.
Please review the official PHP security advisory for remediation guidance.
https://www.php.net/archive/2026.php#2026-10-21-5
Components affected
Sucuri North America West Sucuri North America Central Sucuri North America East Sucuri North America South East Sucuri Europe West Sucuri Europe Central Sucuri Asia East Sucuri South America Sucuri Australia Sucuri DDoS Mitigation Platforms Sucuri DNS InfrastructureTrusted by 1,000+ teams
The Status Page Aggregator with Early Outage Detection
Stop finding out about outages from your users. Monitor 6,320+ cloud services and get alerted the second something breaks.
Latest Updates ( sorted recent to last )
MONITORING
6 days ago - at 10/21/2026 03:14PM
Sucuri has deployed additional Web Application Firewall (WAF) rules to help mitigate attack patterns associated with the recently disclosed critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. We are monitoring these protections and related traffic.
These rules provide an additional layer of protection for traffic passing through the Sucuri Website Firewall. WAF protection does not replace patching PHP on your origin server.
We strongly recommend contacting your hosting provider or server administrator to apply the appropriate PHP security update as soon as possible. The PHP Development Team has released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Your operating system or hosting vendor may also provide patched packages.
Please review the official PHP security advisory for remediation guidance.
https://www.php.net/archive/2026.php#2026-10-21-5
Latest Sucuri outages
Service Degradation in Asia: Increased Latency and Packet Loss - about 1 month ago
Degraded Performance on WAF Cluster 3 - about 2 months ago
SSL Issues - 6 months ago
Change Propagation Delays within the UI - 7 months ago
Degraded Performance on Paris, Frankfurt, and London Regions - 7 months ago
The Status Page Aggregator with Early Outage Detection
With IsDown, you can monitor all your critical services' official status pages from one centralized dashboard and receive instant alerts the moment an outage is detected. Say goodbye to constantly checking multiple sites for updates and stay ahead of outages with IsDown.
Start free trialNo credit card required · Cancel anytime · 6320 services available
Integrations with
