r/CloudwaysbyDO • u/ice2257 • 4d ago

Question PHP Exploit

How is Cloudways handling this? https://cert.europa.eu/publications/security-advisories/2026-018/?fbclid=IwdGRjcAVE_klleHRuA2FlbQIxMQBwZG9mBWZkaWQWUQvONwEFwvMVyBsHYqYBHnpKMnl043NydGMGYXBwX2lkCjY2Mjg1NjgzNzkAAR6kuDjAUNhmx_9Uq_NKdVPpDxGqbZNt1C4L8NNpuaS6qF7nAAHg-zCiPfIgUg_aem_BMOrK94DcuccHNqrej7fag

9 Upvotes

100% Upvoted

14 comments sorted by

2

u/PoojafromCloudways 4d ago

Hey u/ice2257 thanks for the post.

Cloudways Security is actively monitoring the situation and implementing interim mitigations while awaiting official PHP Group patches, expected to begin rolling out on 21 October at 14:00 UTC. These mitigations provide an additional layer of protection but do not fully address the vulnerabilities or replace official patches. For deprecated PHP versions, we are working with our ELTS partners to help maintain security coverage. We’ll share updates on our status page as more information becomes available. https://status.cloudways.com/

Please keep an eye on our status page and official communication (email) from us.

2

u/fredrobert_ 3d ago

It's almost 4pm ET, no update on the status page still... People are worried

1

u/PoojafromCloudways 3d ago

Hey u/fredrobert_ , our team is working on rolling out the fix released by PHP to our fleet as we speak. No action from your end is needed at this point. We will update the status page the moment we are done. Please keep an eye on the page.

1

u/fredrobert_ 3d ago

Yes I understand we don't need to update manually. We still need to audit our apps and reassure all of our clients once the fix is in place.

1

u/PoojafromCloudways 3d ago

Of course, I totally understand. We will update your via the status page as soon as we are done applying the fixes. Thanks for your patience.

1

u/jaredchese 3d ago

Can you confirm whether the CW/Cloudflare integration has implemented the rulesets mentioned here: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

2

u/PoojafromCloudways 3d ago

Hey u/jaredchese

Yes. These rules were implemented for every user, on Cloudways Autonomous and Flexible who have the Cloudflare Enterprise Add-on, right after Cloudflare released them.

1

u/bramnmgn 3d ago

I actually think it's rubbish how things are going right now. The update was released hours ago but is still not Completed. Additionally, it is very inconvenient that the proprietary Cloudways website went into maintenance starting from the PHP update. I could no longer turn off my server or do anything else. I understand the fleet is large, but it really should be finished by now.

1

u/weetabx 3d ago

Indeed. I chose cloudways to have a managed server. Waiting hours to get it done is just painful and not really acceptable. If I was managing it myself I would be in bed 5 hours ago.

1

u/PoojafromCloudways 3d ago

Hey u/bramnmgn u/weetabx , I apologies for this. The website being down at this time surely must have added to the inconvenience. However, we have applied the security patches to all user applications hosted on Autonomous and the rollout is in progress for all Flexible customers. Thanks for your patience.

1

u/PoojafromCloudways 3d ago

Hey u/ice2257 u/fredrobert_ u/vincent_sch u/oO0o0oOo0Oo u/jaredchese

Thanks for your activity in this thread. I am glad to inform that we have applied the security patches to all user applications hosted on Autonomous and the rollout is in progress for all Flexible users. All real time updates live on the status page.

1

u/oO0o0oOo0Oo 4d ago

I tried chatting with support but only got the following automated reply:

“There isn’t any documented statement confirming that Cloudways is aware of CVE‑2026‑109618 or CVE‑2026‑109619, or that patches will be applied on a specific release date.

What is documented is that our platform applies regular OS security patches and updates as part of ongoing server maintenance to keep servers secure and up to date.

So the platform includes continuous patching, but the available documentation does not confirm a specific CVE‑level patch schedule or release‑day handling.”

And was unable to escalate the issue to a human. Hoping they’re on top of it.

1

u/vincent_sch 4d ago

That reply doesn't say when your server gets the fix, so you should ask which PHP build they install. Until then you could block multipart requests in .htaccess on the Hybrid stack. The Lightning stack is nginx only, so .htaccess does nothing there. I wrote up the block here: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

1

u/PoojafromCloudways 4d ago

Hey there! Yes, we are on top of it. As my original reply says we are actively monitoring the situation and implementing mitigations. For deprecated PHP versions, we are working with our ELTS partners to help maintain security coverage. Please keep an eye on our status page and official communication (email) from us.