Notice regarding recently-reported Ruby regular expression vulnerabilities (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264)
On October 23, 2026, the Ruby project released security fixes for vulnerabilities in its regular expression engine (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264). Cloudinary upgraded its core platform, including its upload, transformation, and delivery APIs and Console, to the patched Ruby version on the same day. Our review found no evidence of exploitation and no impact on customers or customer data. No action is required on your part for the Cloudinary platform. Customers who use Ruby in their own applications, including with the Cloudinary Ruby SDK, should update Ruby in their environments to a patched release (3.3.13, 3.4.12, 4.0.9 or later).
The latest update from Cloudinary.
State
Resolved
Started
8 d ago
2026-10-24 07:03 UTC
Lasted
1 min
until 2026-10-24 07:03 UTC
Worst impact
Notice
Timeline
1 updateResolved
1 min 100%
Updates
Times in UTCAs posted by Cloudinary
On October 23, 2026, the Ruby project released security fixes for vulnerabilities in its regular expression engine (CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264). Cloudinary upgraded its core platform, including its upload, transformation, and delivery APIs and Console, to the patched Ruby version on the same day. Our review found no evidence of exploitation and no impact on customers or customer data. No action is required on your part for the Cloudinary platform. Customers who use Ruby in their own applications, including with the Cloudinary Ruby SDK, should update Ruby in their environments to a patched release (3.3.13, 3.4.12, 4.0.9 or later).
Cloudinary in the last 90 days
Full historyIncidents in 90 days
5
Days with an incident
6
Median duration
1 h 47 min
This incident
100% shorter than the median
Other Cloudinary incidents
All incidentsCloudinary·Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Regarding the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 Cloudinary’s core platform, including its upload, transformation, and delivery APIs and Console, does not use PHP and is not affected by these vulnerabilities. Please note that customers who use the Cloudinary PHP SDK in their own applications should update PHP in their respective environments
Cloudinary·Issues accessing the Cloudinary web UI
This incident has been resolved. The UI and console, including login, is operating normally. We apologize for the inconvenience.
Cloudinary·Increased Error Rates – EU Region
This incident has been resolved.
Cloudinary·Media Library / asset visibility
This incident has been resolved.
Follow Cloudinary
Your coding agent knows when Cloudinary is down, and tells you when a failure is theirs, not yours. You can also get Cloudinary incidents in a feed reader or in Slack.
Install the outages.live MCP server, so that when something breaks you can tell if the cause is a provider we depend on and not my code. It reads the official status pages of cloud, AI, payment and developer providers and gives you their incidents as MCP tools.
Add it as a remote MCP server named "outages" at https://outages.cc/mcp (Streamable HTTP, no authentication), with your CLI command or your MCP config file.
Then:
1. Make sure it connects and shows the tools get_provider, list_feed and send_feedback.
2. Call get_provider with "cloudinary" and tell me if Cloudinary has a problem right now.
3. From now on, when a call to a third-party service fails or becomes slow, call get_provider for that service before you change my code.Paste this into any coding agent. It adds the server with its own MCP setup.
https://outages.cc/feed.xml?providers=cloudinary/feed subscribe https://outages.cc/feed.xml?providers=cloudinaryFAQ
Go from tracking outages to fixing production issues with Polylane.
Try Polylane