Customer Security Advisory: PHP Remote Code Execution Vulnerabilities

What to do

• Check whether your product depends on Akamai Cloud (Linode). Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 2d 5h it lasted.

  Anything that failed between 2026-10-21 14:44 UTC and 2026-10-23 20:37 UTC may need a replay.

• Subscribe to Akamai Cloud (Linode)'s feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=linode works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Akamai Cloud (Linode) 5

1. investigatingOct 21, 2026, 2:44 PM UTC

   Akamai is aware of the recently published (CVE-2026-109618 and CVE-2026-109619) vulnerabilities and our teams are actively investigating its potential impact across our platform and infrastructure. As a part of ongoing mitigation efforts, some Quick Deploy Apps, speed test pages, and parts of the website may be unavailable. If you are running a vulnerable version of PHP on a Linode instance, we recommend following guidance from the upstream vendor (PHP) and applying upstream patches as they become available. We will provide updates as additional information becomes available.

   provider

2. identifiedOct 21, 2026, 5:41 PM UTC

   Updated Guidance after assessment: Akamai is aware of the recently published (CVE-2026-109618 and CVE-2026-109619) vulnerabilities and our teams are actively investigating its potential impact across our platform and infrastructure. As a part of ongoing mitigation efforts, our Cloud Infrastructure Speed Tests will be unavailable. If you are running a vulnerable version of PHP on a Linode instance, we recommend following guidance from the upstream vendor (PHP) and applying upstream patches as they become available. We will provide updates as additional information becomes available.

   provider

3. identifiedOct 22, 2026, 6:19 PM UTC

   Akamai is aware of the recently published (CVE-2026-109618 and CVE-2026-109619) vulnerabilities and our teams are actively investigating its potential impact across our platform and infrastructure. As a part of ongoing mitigation efforts, our Cloud Infrastructure Speed Tests will be unavailable. If you are running a vulnerable version of PHP on a Linode instance, we recommend following guidance from the upstream vendor (PHP) and applying upstream patches as they become available. We will provide updates as additional information becomes available.

   provider

4. resolvedOct 23, 2026, 8:37 PM UTC

   Akamai has completed its assessment of the recently published PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) across our platform and infrastructure, and mitigation efforts are complete. Cloud Infrastructure Speed Tests will remain offline in the near term. We plan to bring them back online in the near future. If you are running a vulnerable version of PHP on a Linode instance, we recommend following guidance from the upstream vendor (PHP) and applying upstream patches as they become available. We appreciate your patience while our teams completed this work.

   provider

5. postmortemOct 29, 2026, 8:40 AM UTC

   On October 10, 2026, Akamai became aware of two zero-day remote code execution \(RCE\) vulnerabilities affecting the PHP core engine, tracked as CVE-2026-109618 and CVE-2026-109619. Akamai began a platform-wide investigation, and deployed global Web Application Firewall \(WAF\) mitigation rules on October 21, 2026, and carried out remediation protocols across potentially impacted infrastructure. At this time, Akamai has observed no evidence that these vulnerabilities impacted core Akamai products, API calls, or the Akamai Control Center \(ACC\). The potential scope included PHP Core, Linode Speed Test Services, and Quick Deploy Marketplace applications. As a precaution, Akamai temporarily disabled Cloud Infrastructure Speed Tests while teams isolated and rebuilt related systems. Akamai deployed protective WAF rules across the Akamai edge platform to inspect and mitigate potential exploitation attempts. Marketplace application templates were also updated so new Linode Compute Marketplace deployments automatically use patched PHP packages. The existing customer-managed instances running vulnerable PHP versions require customer action to apply the latest official security updates from the upstream PHP project. Customers using Akamai App & API Protector or Kona Site Defender should confirm that default protective rule sets are active. Customers running PHP on Linode compute instances or other self-managed infrastructure should update PHP packages as soon as possible. The external asset scans confirmed that Akamai production environments remained secured and protected. Akamai's public security notice is available [here](https://www.akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core). This summary provides an overview of our current understanding of the incident given the information available. Our investigation is ongoing, and any information herein is subject to change.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.