P2 - [WEBHOSTING] - PHP Emergency maintenance

Incident Report for Scaleway

Identified

The PHP project released today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5

As a precaution, we have taken Webhosting websites offline while we apply the patched PHP versions. Our team is actively working to patch and restore the service as soon as possible.

Posted Oct 21, 2026 - 16:38 CEST

This incident affects: Dedibox - Products (Hosting) and Elements - Products (Web Hosting).