Today, the PHP Group disclosed critical Remote Code Execution (RCE) vulnerabilities affecting PHP. Because PHP powers a significant share of the web, including WordPress, Drupal, Laravel, and custom applications, we notified all customers this morning.
To follow up on our previous notice on status.cloudways.com, we are implementing further latest interim configuration-level mitigations recommended by the PHP Group while preparing for a phased rollout of the official patches across our fleet. These interim measures provide an additional layer of protection while patch deployment is underway.
For deprecated PHP versions, we are working with our ELTS partners to apply the appropriate security patches and maintain security coverage.
Posted Oct 21, 2026 - 16:43 UTC
Identified
Cloudways Security is closely monitoring the situation and implementing interim mitigations (that may cause a short service disruption) to strengthen the security of affected PHP environments while awaiting the release of official patches from the PHP Group. The PHP Group has announced that patch releases are expected to begin on 21 October 2026 at 14:00 UTC, with availability varying by PHP version.
For deprecated PHP versions, Cloudways is leveraging its Extended Long Term Support (ELTS) partnerships to help maintain security coverage and address vulnerabilities where official patches may not be available.
Customers will receive further updates via email, and this status page will be updated as new information becomes available.
Posted Oct 21, 2026 - 09:16 UTC
This incident affects: Cloudways Cloud Platform Console and Cloudways Cloud Platform Service.