Active incident
P2 - [WEBHOSTING] - PHP Emergency maintenance
Scaleway · Critical · Started
- Duration
- Ongoing
- Severity
- Critical
- Status
- Identified
Summary
Critical · Identified
[Update] Security Maintenance – Web Hosting Services Security patching for the php2shell vulnerability is progressing: cPanel Environments (Resolved): PHP versions have been updated across all Scaleway and Online.net cPanel servers (as well as Scaleway Plesk). Maintenance mode has been lifted, and services are back online. Classic Shared Hosting / Mutu (In Progress): Classic shared environments remain under maintenance while work is actively underway.
Event timeline
How this incident unfolded, from the official status page.
Identified
Scaleway
The PHP project released today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5 As a precaution, we have taken Webhosting websites offline while we apply the patched PHP versions. Our team is actively working to patch and restore the service as soon as possible.
Identified
Scaleway
[Update] Security Maintenance – Web Hosting Services Security patching for the php2shell vulnerability is progressing: cPanel Environments (Resolved): PHP versions have been updated across all Scaleway and Online.net cPanel servers (as well as Scaleway Plesk). Maintenance mode has been lifted, and services are back online. Classic Shared Hosting / Mutu (In Progress): Classic shared environments remain under maintenance while work is actively underway.