On October 21, 2026, PHP released fixes for two critical security issues (CVE-2026-109618 and CVE-2026-109619). PHP is the language behind Craft CMS and WordPress, so most websites need this update. Each hosting platform has to make the fix available or apply it. This page shows where each of our hosting partners stands. It checks their public status updates automatically.
Last checked (3:43 PM CDT) · refreshes every 15 minutes
Where things stand: The updated server images are now available, but Railway has paused builds and deployments on its platform during an outage, so the update can't be deployed until Railway resolves it.
Next step: Once the updated images are published and Railway builds are running, we redeploy each site on Railway and confirm it's running the fixed version.
Railway status page →Where things stand: The updated PHP packages are available, and our team is applying them to each server and confirming the fix is running. Most servers are already updated.
Next step: As soon as the updated packages are available, our team applies them to each server and confirms the fix is running.
Where things stand: WP Engine is applying updated PHP across its platform and has added protections at its network edge.
Latest from WP Engine“We are currently deploying patches to the platform. Protective mitigations remain active at the CDN layer and at the hosting layer. Further updates will be provided as they are available.”
Next step: No action needed. WP Engine applies the update; we'll confirm once it's complete.
WP Engine status page →Where things stand: Pantheon is applying updated PHP across its platform.
Latest from Pantheon“We have patched all live production sites running supported PHP versions (8.2 - 8.5).”2026-10-21 12:49 PT
Next step: No action needed. Pantheon applies the update automatically.
Pantheon status page →Where things stand: Done. Every Servd site we host has been rebuilt on Servd's patched PHP release, in both production and staging, and file uploads are working again.
Latest from Servd“We've now released patched PHP versions for 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Please proceed to build and sync new bundles to all your environments. When a safe bundle is deployed to an environment, our platform will automatically disable the multipart…”17:33 UTC - 21 October 2026
Next step: None needed. We confirmed the updated build is live on each site and will keep an eye on Servd's status page.
Servd status page →Where things stand: Done. fortrabbit has applied the updated PHP, and we've confirmed it's running on every fortrabbit site we host, in both production and staging.
Next step: None needed. We'll keep an eye on fortrabbit's maintenance notice until it's closed.
fortrabbit status page →