# Linode (Akamai): Incident updated: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities

> Incident updated: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities. Detected 2026-10-29 by Rewindex: what changed on Linode (Akamai)’s status page, with the before/after diff.

Canonical: https://rewindex.com/change/ra5ec19a7055582
Last updated: 2026-10-29T08:43:43Z

**Summary:** _summary pending_
- Kind: Incident update · Label: Normal progress (rule)
- Changed: 2026-10-29 08:43 UTC · Detected: 2026-10-29 08:43 UTC
- [Source: https://stspg.io/5yrzq18zhvjz](https://stspg.io/5yrzq18zhvjz)
- [Company: Linode (Akamai)](https://rewindex.com/company/linode-akamai.md)
- Versions: before incident\_version:86/wq8zlhk736fk@7abe5cbfe28e → after incident\_version:86/wq8zlhk736fk@a649d18889a0
- Change 6 of 6 for this incident

Incident page (full timeline): [Customer Security Advisory: PHP Remote Code Execution Vulnerabilities](https://rewindex.com/company/linode-akamai/incidents/wq8zlhk736fk.md)
## What changed

**1. Changed: Status**

```diff
- resolved
+ postmortem
```

**2. Added: Update** (postmortem) · 2026-10-29 08:40 UTC

```diff
+ On October 10, 2026, Akamai became aware of two zero-day remote code execution (RCE) vulnerabilities affecting the PHP core engine, tracked as CVE-2026-109618 and CVE-2026-109619. Akamai began a platform-wide investigation, and deployed global Web Application Firewall (WAF) mitigation rules on October 21, 2026, and carried out remediation protocols across potentially impacted infrastructure. At this time, Akamai has observed no evidence that these vulnerabilities impacted core Akamai products, API calls, or the Akamai Control Center (ACC). The potential scope included PHP Core, Linode Speed Test Services, and Quick Deploy Marketplace applications. As a precaution, Akamai temporarily disabled Cloud Infrastructure Speed Tests while teams isolated and rebuilt related systems. Akamai deployed protective WAF rules across the Akamai edge platform to inspect and mitigate potential exploitation attempts. Marketplace application templates were also updated so new Linode Compute Marketplace deployments automatically use patched PHP packages. The existing customer-managed instances running vulnerable PHP versions require customer action to apply the latest official security updates from the upstream PHP project. Customers using Akamai App & API Protector or Kona Site Defender should confirm that default protective rule sets are active. Customers running PHP on Linode compute instances or other self-managed infrastructure should update PHP packages as soon as possible. The external asset scans confirmed that Akamai production environments remained secured and protected. Akamai's public security notice is available here. This summary provides an overview of our current understanding of the incident given the information available. Our investigation is ongoing, and any information herein is subject to change.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-21 16:13 UTC | [Incident silently edited: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities](https://rewindex.com/change/radaee87e7cef5c.md) | Wording only |
| 2026-10-21 17:43 UTC | [Incident updated: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities](https://rewindex.com/change/r2be01db586a5a7.md) | Normal progress |
| 2026-10-21 17:53 UTC | [Incident silently edited: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities](https://rewindex.com/change/r4f35ba58b1e022.md) | minor edit |
| 2026-10-22 18:24 UTC | [Incident updated: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities](https://rewindex.com/change/red69c1008fc9ca.md) | Normal progress |
| 2026-10-23 20:43 UTC | [Incident updated: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities](https://rewindex.com/change/rdfb1121a7efdf4.md) | Normal progress |
| 2026-10-29 08:43 UTC | Incident updated: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities (this change) | Normal progress |

Previous: [change](https://rewindex.com/change/rdfb1121a7efdf4.md) · All Linode (Akamai) changes: [timeline](https://rewindex.com/company/linode-akamai/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._

## Cite this

Incident updated: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities on Linode (Akamai)’s status page, changed 2026-10-29 08:43 UTC (change 6 of 6).

- Canonical URL: https://rewindex.com/change/ra5ec19a7055582
- Citation: Linode (Akamai), “Incident updated: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities” (2026-10-29 08:43 UTC). Archived by Rewindex: https://rewindex.com/change/ra5ec19a7055582 (CC BY 4.0).
- Markdown link: `[Linode (Akamai): Incident updated: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities (2026-10-29)](https://rewindex.com/change/ra5ec19a7055582)`


---
Canonical: https://rewindex.com/change/ra5ec19a7055582 · Markdown: https://rewindex.com/change/ra5ec19a7055582.md · JSON: https://rewindex.com/api/v1/changes/ra5ec19a7055582 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-11T05:02:31.288Z