{
  "meta": {
    "version": "v1",
    "pricing": {
      "public": {
        "label": "Public",
        "description": "Read-only API access for lightweight status checks and public integrations."
      },
      "premium": {
        "label": "Premium",
        "description": "API keys with higher hourly quotas, plus Slack, Teams, Discord, webhook, and email outage alerts across your vendor stack."
      }
    },
    "generatedAt": "2026-10-22T22:02:39.813Z"
  },
  "data": {
    "id": "incident_statuspage_pantheon_x7h8z1yhgvml",
    "slug": "pantheon-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-2026-10-21",
    "title": "PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619",
    "summary": "PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619",
    "status": "resolved",
    "stale": false,
    "severity": "minor",
    "startedAt": "2026-10-21T14:03:40.415+00:00",
    "updatedAt": "2026-10-22T16:36:36.46+00:00",
    "resolvedAt": "2026-10-22T16:36:36.437+00:00",
    "provider": {
      "slug": "pantheon",
      "name": "Pantheon"
    },
    "affectedServices": [
      {
        "slug": "pantheon-sites",
        "name": "Customer Sites"
      }
    ],
    "links": {
      "html": "/incidents/pantheon-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-2026-10-21",
      "api": "/api/v1/incidents/pantheon-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-2026-10-21",
      "providerHtml": "/providers/pantheon",
      "alerts": "https://outagedeck.com/account?stack=pantheon&utm_source=api&utm_medium=response&utm_campaign=api_alerts&utm_content=incident"
    },
    "impactSummary": "Pantheon reported this event with no impact level.",
    "source": {
      "id": "source_pantheon_status",
      "kind": "official_api",
      "name": "Pantheon Operations Status",
      "checkedAt": "2026-10-22T22:00:12.567+00:00",
      "stale": false,
      "officialUrl": "https://status.pantheon.io",
      "statusPageUrl": "https://status.pantheon.io"
    },
    "updates": [
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_wz1ypg5lk27b",
        "status": "investigating",
        "body": "Pantheon is actively mitigating against the PHP security vulnerabilities announced at 14:00 UTC today. PHP environments are being patched to the following versions:\n\n8.5.12\n8.4.27\n8.3.36\n8.2.35\n\nAdditionally, we are patching the following heirloom PHP branches via our LTS vendor:\n\n8.1.x\n8.0.x\n7.4.x\n7.3.x\n7.2.x\n7.1.x\n7.0.x\n5.6.x\n\nFinally, in preparation for this event, we pre-emptively deployed configuration changes to the runtime environment to mitigate potential attack vectors, and have implemented network-level mitigations to deflect attempted exploit payloads across the platform.\n\nNo action is required from customers, as all available versions of PHP on Pantheon receive security updates through our LTS vendor. However, we continue to recommend that customers running on older versions of PHP that have reached End of Sale update to a version fully supported by the PHP community in order to minimize their overall risk. \n\nTo pin your version of PHP to a different version, see https://docs.pantheon.io/guides/php/php-versions.\n\nWe will update this post as patching progresses and as we learn more about the vulnerability.",
        "createdAt": "2026-10-21T14:03:40.48+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_5x3xl4ns1jqq",
        "status": "investigating",
        "body": "Updated PHP versions addressing CVE-2026-109618 and CVE-2026-109619 are now available, and we are beginning the process of rolling them out across our infrastructure.\n\nNo action is required from customers.\n\nWe will continue to update this post as the rollout progresses.",
        "createdAt": "2026-10-21T14:36:53.483+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_9lsx61r2162b",
        "status": "investigating",
        "body": "Patching work is still in progress. Environments are being updated in stages, and protective mitigations remain active across the platform while the remaining updates complete. \n\nWe are not yet seeing evidence of any volumetric exploit attempts. No customer action is needed. We will provide further updates as the rollout progresses.",
        "createdAt": "2026-10-21T16:07:34.726+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_gf9jxvvzmcmp",
        "status": "investigating",
        "body": "Patches continue rolling out across the infrastructure in stages, and protective mitigations remain active. We have not observed any volumetric exploit attempts, and no customer action is required.",
        "createdAt": "2026-10-21T17:17:18.384+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_zmj9ly2jsdzp",
        "status": "identified",
        "body": "Patching continues to roll out across the infrastructure in stages, with protective mitigations remaining active. We have not observed any volumetric exploit attempts, and no customer action is required. \n\nWe expect to provide an estimated completion time for the patching rollout within the next hour.",
        "createdAt": "2026-10-21T18:22:13.449+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_trvs0kg5n1v0",
        "status": "identified",
        "body": "We estimate the complete rollout for live environments on supported PHP versions (8.2 -> 8.5) within the next 20 minutes. \n\nWe are also prioritizing pre-production environments for paying customers, and have preemptively patched development or mutli-dev environments that were toggled into a mutable code state (“SFTP mode”).\n\nWe will provide an update on LTS versions of PHP (8.1.x through 5.6.x) once our upstream vendor has backported the patches and made updates available. That work has been in progress since 14:00 UTC.\n\nOur network-level mitigations remain effective, and are blocking a low but slowly increasing level of activity which is probing the vulnerable surface area. \nAt this time we do not see evidence of widespread exploitation attempts, or any successful exploits.\n\nWe will continue to deliver patched versions of PHP as quickly as possible, and maintain network level mitigation and continuous monitoring to provide our customers and the wider PHP community insights into how this situation plays out",
        "createdAt": "2026-10-21T19:30:32.479+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_pzbc4gnv4hf9",
        "status": "identified",
        "body": "We have patched all live production sites running supported PHP versions (8.2 - 8.5).",
        "createdAt": "2026-10-21T19:49:00.94+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_7j73qd0tszjk",
        "status": "identified",
        "body": "We have received LTS updates from our upstream vendor and are working to deploy the patch to older versions of PHP. \n\nWe will post an update on that once it is complete or we have a clear ETA.\nOur network-level mitigations remain effective and we see no evidence of compromise for any sites on the platform.",
        "createdAt": "2026-10-21T21:32:58.552+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_khryp6jgy9ln",
        "status": "identified",
        "body": "Patched PHP builds are now available for all supported long-term support (LTS) PHP versions, and rollout to live environments running end-of-life PHP versions is underway. Live environments running fully supported PHP versions (8.2 and later) have already been patched.",
        "createdAt": "2026-10-21T22:13:36.894+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_ml717b3ybk6t",
        "status": "identified",
        "body": "We have completed patching production environments for all sites running LTS versions of PHP.",
        "createdAt": "2026-10-22T00:16:48.243+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_hjqp6cr925dp",
        "status": "identified",
        "body": "Patched PHP builds have been deployed to all LTS environments, all environments in SFTP mode, and all live environments running PHP 8.2 or later. Most paid non-live environments running PHP 8.2 or later are also patched. We expect the remaining rollout to continue over the next 24 to 48 hours.",
        "createdAt": "2026-10-22T01:42:07.597+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_r4jp42dzxkjf",
        "status": "monitoring",
        "body": "We can now confirm that all pre-production customer environments are patched. Free/sandbox environments will be updated over the next 24-48 hours.\n\nOver the course of today, our network-level mitigations have blocked over 60,000 suspicious requests probing the vulnerability, and remain in place.\n\nThis concludes our ongoing updates. We will share more analysis in the future based on what we can observe, but as of now, active mitigation work is complete.",
        "createdAt": "2026-10-22T02:08:32.453+00:00"
      },
      {
        "id": "update_statuspage_pantheon_x7h8z1yhgvml_pj43q6rgd8fv",
        "status": "resolved",
        "body": "Overnight monitoring continues to show persistent but limited probing, which is being blocked. Our rollout of updated PHP images across customer environments including LTS versions was complete as of 5pm Pacific time yesterday. We will continue to observe and may provide further analysis of our findings, but we are closing this incident.",
        "createdAt": "2026-10-22T16:36:36.437+00:00"
      }
    ],
    "access": {
      "plan": "public",
      "keyed": false
    }
  }
}