STO1 - Stockholm South, STO2 - Stockholm West, STO3 - Stockholm North
October 21, 2026 17:25 CEST
October 21, 2026 15:25 UTC
IDENTIFIED
Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) allow unauthenticated remote code execution. Fixed PHP versions are out, and we are waiting for our supplier to release updated images so we can patch the platform. There is currently no indication that our platform has been compromised, but stopping your environment is the only way to be certain.
If you run your own PHP, we strongly recommend upgrading to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later.
We will post an update by 21:00 CEST at the latest, but hope to have it patched by then.October 21, 2026 21:11 CEST
October 21, 2026 19:11 UTC
IDENTIFIED
We are still waiting for our supplier to release updated images, so the platform is not yet patched. Next update will be tomorrow at 08:30 CEST.October 22, 2026 08:35 CEST
October 22, 2026 06:35 UTC
IDENTIFIED
The supplier has issued new images for most of the affected versions. We urge our customers to swiftly update your environment using the available patched images.
Remaining images are being worked on.October 22, 2026 11:10 CEST
October 22, 2026 09:10 UTC
IDENTIFIED
Regarding remaining patches the latest information we have from supplier is:
LiteSpeed: Targeting publication by EOD today (EEST, UTC+3).
Database templates: Estimated 1-2 days due to longer testing cycles.
Unfortunately we do not get live updates regarding these patches and urge customers to keep an eye out for patched images, as they might arrive before we get the possibility to share information about their availability.October 22, 2026 22:26 CEST
October 22, 2026 20:26 UTC
IDENTIFIED
We now have information that MySQL, LiteSpeed and LLSMP has updated images in the platform. When verifying availability of the announced images we notice that also LEMP seem to have a patched image available.
As mentioned we do not get live updates regarding the patches. Customers still waiting for patched images should keep an eye out for them, as they might arrive before we get the possibility to share information about their availability.October 23, 2026 15:51 CEST
October 23, 2026 13:51 UTC
IDENTIFIED
We now have information that MariaDB and PostgreSQL have patched images in the platform.
As earlier informed we do not get live updates regarding the patches. Customers still waiting for patched images should keep an eye out for them, as they might arrive before we get the possibility to share information about their availability.October 26, 2026 15:49 CET
October 26, 2026 14:49 UTC
RESOLVED
We do not have indications or a time plan regarding more patches to arrive from Virtuozzo and have thus decided to close this incident.
If by any chance your specific application needs an updated image which has not arrived, feel free to reach out to our support and we will forward your request to Virtuozzo.
