Scaleway: P2 - [WEBHOSTING] - PHP Emergency maintenance
Affected components: Elements - Products - Web HostingWeb HostingDedibox - Products - HostingHosting
Timeline of updates
- identified
The PHP project released today a fix for two critical vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5 (opens in new tab)
As a precaution, we have taken Webhosting websites offline while we apply the patched PHP versions. Our team is actively working to patch and restore the service as soon as possible.
Changes Rewindex caught on this incident
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
Rewindex captured this after the last checkpoint; the next run () commits it.
Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).