PHP Security Vulnerability Update

What to do

• Check whether you use Kinsta MyKinsta. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 13h 22m it lasted.

  Anything that failed between 2026-10-21 19:04 UTC and 2026-10-22 08:26 UTC may need a replay.

• Subscribe to Kinsta's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=kinsta works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Kinsta 8

1. investigatingOct 21, 2026, 7:04 PM UTC

   We're actively addressing the PHP security vulnerability announced by the PHP security team. As PHP is managed at the platform level on Kinsta, fixes will be deployed automatically once validated. We do want to clarify that the attacks are being successfully mitigated by our Cloudflare site protections, across all our sites, based on rules created specifically for these vulnerabilities. We continue to maintain multiple comprehensive levels of security to mitigate any potential attacks. The patched versions of PHP 8.3 and 8.5 have now been validated and are being rolled out across our platform. If your site is already using either version and you'd like to apply the patch immediately, you can switch to a lower PHP version and then back to your original version. Updates for PHP 8.4, 8.2, 8.1, and 7.4 are still undergoing validation and will be rolled out once ready. No action is required on your end. We'll provide further updates as the rollout progresses.

   provider

2. investigatingOct 21, 2026, 8:20 PM UTC

   The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, and 8.0 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4, 8.2, 8.1, and 7.4 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

   provider

3. investigatingOct 21, 2026, 9:17 PM UTC

   The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.0, and 7.4 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4, 8.2, and 8.1 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

   provider

4. investigatingOct 21, 2026, 10:06 PM UTC

   The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.1, 8.0, and 7.4 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4 and 8.2 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

   provider

5. investigatingOct 21, 2026, 11:25 PM UTC

   The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.1, 8.0, 7.4, 8.2, and 8.4. Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

   provider

6. investigatingOct 22, 2026, 1:31 AM UTC

   The following PHP versions have patches that are rolling out across our infrastructure: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

   provider

7. investigatingOct 22, 2026, 8:25 AM UTC

   The following PHP versions have patches that are rolling out across our infrastructure: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

   provider

8. resolvedOct 22, 2026, 8:26 AM UTC

   All sites are protected, the PHP security updates have been rolled out across the platform, and we have no evidence of any breaches related to this vulnerability.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.