We are continuing to monitor for any further issues.
Posted Oct 22, 2026 - 10:22 UTC
Update
The PHP security patch rollout is complete, and all active servers have been successfully updated. Our support team is proactively reaching out to a small subset of customers whose environments require additional assistance.
If you have any questions, please reach out to our support team.
Posted Oct 22, 2026 - 10:20 UTC
Update
The PHP security patch rollout is complete, and all active servers have been successfully updated. Our support team is proactively reaching out to a small subset of customers whose environments require additional assistance.
If you have any questions. please reach out to our support team.
Posted Oct 22, 2026 - 10:11 UTC
Update
The PHP security patch rollout is in its final stage, with the majority of servers now patched. Our team is completing the remaining instances and we expect all patching to be completed by 09:00 UTC.
Interim protections remain in place until then and no action is needed from the customers.
Posted Oct 22, 2026 - 07:03 UTC
Update
The PHP security patch is being deployed to customer applications hosted on Flexible. Rollout is in progress and proceeding on schedule across all remaining instances. No action is needed from the customers. We will share a final update once the activity is completed.
Our interim protections remains in place for all sites until the deployment is complete.
Posted Oct 22, 2026 - 04:07 UTC
Monitoring
We have applied security patches for all customer applications hosted on Autonomous. In parallel, we continue to rollout patches for applications hosted on Flexible.
Posted Oct 22, 2026 - 01:02 UTC
Update
To follow up on our previous notice, interim configuration-level mitigations recommended by the official PHP Group have been deployed across the fleet. The phased rollout of official security patches is currently in progress, with these interim measures providing an additional layer of protection while patch deployment continues toward completion across the entire fleet.
We are applying security patches across all Cloudways-supported PHP versions, including deprecated versions, covering PHP 5.6 and above. The rollout is currently in progress and includes PHP 5.6, 7.4, 8.0, 8.1, 8.2, 8.3, and 8.4, using the corresponding security patches for each version.
This maintenance activity does not impact the availability or operation of Cloudways Platform, customer websites, or Affiliate Portal services.
Posted Oct 21, 2026 - 22:19 UTC
Update
Today, the PHP Group disclosed critical Remote Code Execution (RCE) vulnerabilities affecting PHP. Because PHP powers a significant share of the web, including WordPress, Drupal, Laravel, and custom applications, we notified all customers this morning.
To follow up on our previous notice on status.cloudways.com, we are implementing further latest interim configuration-level mitigations recommended by the PHP Group while preparing for a phased rollout of the official patches across our fleet. These interim measures provide an additional layer of protection while patch deployment is underway.
For deprecated PHP versions, we are working with our ELTS partners to apply the appropriate security patches and maintain security coverage.
Posted Oct 21, 2026 - 16:43 UTC
Identified
Cloudways Security is closely monitoring the situation and implementing interim mitigations (that may cause a short service disruption) to strengthen the security of affected PHP environments while awaiting the release of official patches from the PHP Group. The PHP Group has announced that patch releases are expected to begin on 21 October 2026 at 14:00 UTC, with availability varying by PHP version.
For deprecated PHP versions, Cloudways is leveraging its Extended Long Term Support (ELTS) partnerships to help maintain security coverage and address vulnerabilities where official patches may not be available.
Customers will receive further updates via email, and this status page will be updated as new information becomes available.
Posted Oct 21, 2026 - 09:16 UTC
This incident affects: Cloudways Cloud Platform Console and Cloudways Cloud Platform Service.