PHP Security Vulnerability Update
All sites are protected, the PHP security updates have been rolled out across the platform, and we have no evidence of any breaches related to this vulnerability.
The latest update from Kinsta.
State
Resolved
Started
11 d ago
2026-10-21 19:04 UTC
Lasted
13 h 22 min
until 2026-10-22 08:26 UTC
Worst impact
Notice
Timeline
8 updatesInvestigating
13 h 22 min 100%
Updates
Times in UTCAs posted by Kinsta
All sites are protected, the PHP security updates have been rolled out across the platform, and we have no evidence of any breaches related to this vulnerability.
The following PHP versions have patches that are rolling out across our infrastructure: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
The following PHP versions have patches that are rolling out across our infrastructure: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.1, 8.0, 7.4, 8.2, and 8.4. Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.1, 8.0, and 7.4 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4 and 8.2 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.0, and 7.4 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4, 8.2, and 8.1 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, and 8.0 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4, 8.2, 8.1, and 7.4 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
We're actively addressing the PHP security vulnerability announced by the PHP security team. As PHP is managed at the platform level on Kinsta, fixes will be deployed automatically once validated. We do want to clarify that the attacks are being successfully mitigated by our Cloudflare site protections, across all our sites, based on rules created specifically for these vulnerabilities. We continue to maintain multiple comprehensive levels of security to mitigate any potential attacks. The patched versions of PHP 8.3 and 8.5 have now been validated and are being rolled out across our platform. If your site is already using either version and you'd like to apply the patch immediately, you can switch to a lower PHP version and then back to your original version. Updates for PHP 8.4, 8.2, 8.1, and 7.4 are still undergoing validation and will be rolled out once ready. No action is required on your end. We'll provide further updates as the rollout progresses.
Affected components
1Kinsta in the last 90 days
Full historyIncidents in 90 days
13
Days with an incident
29
Median duration
6 h 27 min
This incident
2.1× the median
Other Kinsta incidents
All incidentsKinsta·Downloadable Backup actions are stuck in processing status in the MyKinsta Dashboard.
This incident has been resolved.
Kinsta·MFA emails not being sent for MyKinsta
Following continued monitoring, we can confirm that MyKinsta email functionality has been operating normally, with no further issues observed. If you are still experiencing issues, please email us at support@kinsta.com.
Kinsta·Information in regards to newly discovered PHP vulnerability CVE-2026-115560 (Oct 23, 2026)
We can confirm that the mitigations have been successful and no compromises have occurred as a result of this. If you have any other questions, please contact our support team at support@kinsta.com.
Kinsta·Partial outage in London datacenter
The infrastructure has remained stable and this has been resolved.
Kinsta·Service disruption at the Northern Virginia (US East 4) data center
This has been resolved.
Follow Kinsta
Your coding agent knows when Kinsta is down, and tells you when a failure is theirs, not yours. You can also get Kinsta incidents in a feed reader or in Slack.
Install the outages.live MCP server, so that when something breaks you can tell if the cause is a provider we depend on and not my code. It reads the official status pages of cloud, AI, payment and developer providers and gives you their incidents as MCP tools.
Add it as a remote MCP server named "outages" at https://outages.cc/mcp (Streamable HTTP, no authentication), with your CLI command or your MCP config file.
Then:
1. Make sure it connects and shows the tools get_provider, list_feed and send_feedback.
2. Call get_provider with "kinsta" and tell me if Kinsta has a problem right now.
3. From now on, when a call to a third-party service fails or becomes slow, call get_provider for that service before you change my code.Paste this into any coding agent. It adds the server with its own MCP setup.
https://outages.cc/feed.xml?providers=kinsta/feed subscribe https://outages.cc/feed.xml?providers=kinstaFAQ
Go from tracking outages to fixing production issues with Polylane.
Try Polylane