# Scaleway: [Serverless Functions][fr-par/nl-ams/pl-waw] Security updates applied to PHP and Node.js runtimes

- Provider: [Scaleway](https://outages.cc/scaleway.md)
- Type: Incident
- State: Resolved
- Worst impact: Degraded performance
- Started: 2026-10-22 15:18 UTC
- Resolved: 2026-10-22 16:10 UTC (lasted 51 min)
- Components: fr-par-1, fr-par-2, fr-par-3, nl-ams-1, nl-ams-2, nl-ams-3, pl-waw-1, pl-waw-2, pl-waw-3, Serverless Functions, Elements - AZ - fr-par-1, Elements - AZ - fr-par-2, Elements - AZ - fr-par-3, Elements - AZ - nl-ams-1, Elements - AZ - nl-ams-2, Elements - AZ - nl-ams-3, Elements - AZ - pl-waw-1, Elements - AZ - pl-waw-2, Elements - AZ - pl-waw-3, Elements - Products - Serverless Functions
- Official update: https://stspg.io/psrxk8klfv5x

## Updates from Scaleway

### resolved, 2026-10-22 16:10 UTC

This incident has been resolved.

### monitoring, 2026-10-22 15:28 UTC

A fix has been implemented and we are monitoring the results.

### investigating, 2026-10-22 15:18 UTC

We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions. --- PHP Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Actions taken: - Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched. - Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12). Impact for you: - PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5. - If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift. --- Node.js Patched versions of Node.js 22, 24 and 26