rewindex

CompaniesScalewayIncidents

Scaleway: [Serverless Functions][fr-par/nl-ams/pl-waw] Security updates applied to PHP and Node.js runtimes

MinorStatus: resolvededitedStarted Resolved (51 min)3 updatesstatus.scaleway.com (opens in new tab)

CVEs mentioned

Only CVEs the vendor’s text names by id, or that its notice says it is not affected by. A mention is not a statement that the vulnerability caused this incident.

Affected components: Elements - AZ - fr-par-1Elements - AZ - fr-par-2Elements - AZ - fr-par-3Elements - AZ - nl-ams-1Elements - AZ - nl-ams-2Elements - AZ - nl-ams-3Elements - AZ - pl-waw-1Elements - AZ - pl-waw-2Elements - AZ - pl-waw-3Elements - Products - Serverless Functionsfr-par-1fr-par-2fr-par-3nl-ams-1nl-ams-2nl-ams-3pl-waw-1pl-waw-2pl-waw-3Serverless Functions

Timeline of updates

  1. investigating

    We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.
    ---
    PHP
    Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).
    Actions taken:
    - Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
    - Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).
    Impact for you:
    - PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
    - If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.
    ---
    Node.js
    Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.
    If you experience any issue, please contact our support team.
    We apologize for any inconvenience and thank you for your patience.

  2. monitoring

    A fix has been implemented and we are monitoring the results.

  3. resolved

    This incident has been resolved.

Changes Rewindex caught on this incident

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Impact, status and times are the vendor’s own, as last archived. View on status.scaleway.com (opens in new tab).

Scaleway profileRecent Scaleway incidentsMarkdownJSON