QUBA System Status

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

PHP vulnerability resolved (CVE-2026-109618 and CVE-2026-109619)

Resolved - This incident has been resolved.

What was the issue?
The two issues are CVE-2026-109618 and CVE-2026-109619, and are detailed on the NCSC database here: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
At it's core the vulnerability could allow unauthorised code execution on a server under specific conditions. This was possible via triggering an out-of-memory exception, and ultimately a corrupted memory state.
Was I impacted?
The issue only impacted websites and systems running on servers that use PHP, such as WordPress. The vulnerability existed across all PHP versions, and therefore any server with PHP installed was at risk.
What was the fix?
Via our ISO27001 policy, we have a detailed response plan for non conformance events such as this. 
As part of this we were in close contact with PHP hosting partner Cloudways, and they rolled out patches across all of our servers and applications. This is now complete, and is detailed here: https://status.cloudways.com/incidents/xxjt802wwhpk.
We have confirmed with them that all servers are now running patched versions

10/23/2026 11:38:00 AM

PHP vulnerability resolved (CVE-2026-109618 and CVE-2026-109619)

Resolved - This incident has been resolved.

What was the issue?
The two issues are CVE-2026-109618 and CVE-2026-109619, and are detailed on the NCSC database here: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
At it's core the vulnerability could allow unauthorised code execution on a server under specific conditions. This was possible via triggering an out-of-memory exception, and ultimately a corrupted memory state.
Was I impacted?
The issue only impacted websites and systems running on servers that use PHP, such as WordPress. The vulnerability existed across all PHP versions, and therefore any server with PHP installed was at risk.
What was the fix?
Via our ISO27001 policy, we have a detailed response plan for non conformance events such as this. 
As part of this we were in close contact with PHP hosting partner Cloudways, and they rolled out patches across all of our servers and applications. This is now complete, and is detailed here: https://status.cloudways.com/incidents/xxjt802wwhpk.
We have confirmed with them that all servers are now running patched versions

10/23/2026 11:38:00 AM

PHP vulnerability identified (CVE-2026-109618 and CVE-2026-109619)

Identified - We are closely monitoring the vulnerability identifed (CVE-2026-109618 and CVE-2026-109619) and implementing interim mitigations (that may cause a short service disruption) to strengthen the security of affected PHP environments while awaiting the release of official patches from the PHP Group. The PHP Group has announced that patch releases are expected to begin on 21 October 2026 at 14:00 UTC, with availability varying by PHP version.

10/23/2026 8:16:00 AM

PHP vulnerability update 3 (CVE-2026-109618 and CVE-2026-109619)

Update - The PHP security patch rollout is complete, and all active servers have been successfully updated. Our support team is proactively reaching out to a small subset of customers whose environments require additional assistance.

If you have any questions. please reach out to our support team.

10/22/2026 9:20:00 AM

PHP vulnerability update 2 (CVE-2026-109618 and CVE-2026-109619)

Update - To follow up on our previous notice, interim configuration-level mitigations recommended by the official PHP Group have been deployed across our servers. The phased rollout of official security patches is currently in progress, with these interim measures providing an additional layer of protection while patch deployment continues toward completion across the entire fleet.

We are applying security patches across all PHP versions, including deprecated versions, covering PHP 5.6 and above. The rollout is currently in progress and includes PHP 5.6, 7.4, 8.0, 8.1, 8.2, 8.3, and 8.4, using the corresponding security patches for each version.

10/21/2026 9:19:00 PM

PHP vulnerability update 1 (CVE-2026-109618 and CVE-2026-109619)

Update - Today, the PHP Group disclosed critical Remote Code Execution (RCE) vulnerabilities affecting PHP. PHP powers a significant share of the web, including WordPress, Drupal, Laravel, and custom applications.

We are implementing further latest interim configuration-level mitigations recommended by the PHP Group while preparing for a phased rollout of the official patches across our fleet. These interim measures provide an additional layer of protection while patch deployment is underway.

For deprecated PHP versions, we are working with our ELTS partners to apply the appropriate security patches and maintain security coverage.

10/21/2026 3:43:00 PM

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported

No incident reported