What we caught
Trouble at a provider, caught when the companies that rely on it name it on their own status pages, and issues many companies post about at once. The last 30 days; times are UTC.
2 things going on
PHP: 61 companies posted · eMudhra: 10 companies posted
Going on
Earlier
We started keeping these on Oct 20, so the list is shorter than 30 days.
Nothing tied to one place is going on. Grey: the 53 places where status pages we follow list cloud-region parts.
PHP
Shared issue · no single placeOct 21, 03:43 to now61 companies named it on their status pages636 companies in our directory rely on the companies that postedAlso called PHP2Shell, CVE-2026-109618, CVE-2026-109619
- Amazee: “Critical PHP security release”
- Staffbase: “[All Systems] [Security Advisory] – Critical PHP vulnerabilities — no customer-facing service impact”
- Kiln: “Kiln Widget and Dashboard temporarily offline”
- Acorn Works: “PHP Vulnerability | AU-Gov-Cloud (Sydney)”
- Returnless: “Security notice regarding Returnless platform”
- Mews: “Critical 0 day PHP vulnerability”
- Watermelon: “Security Advisory: PHP Vulnerabilities”
- Watermark: “Tk20 Temporarily Offline as a Security Precaution”
- Aptible: “Critical PHP vulnerabilities - customer action may be required”
- Renaissance: “myIGDIs, myON, DnA, Nearpod, SchoolCity, StarPhonics, and eduCLIMBER: Potential Maintenance Today”
- Knak: “Knak PHP security patch”
- Gomomentus: “Statement on PHP CVE's CVE-2026-109618 and CVE-2026-109619”
- Honorlock: “Proactive Outage”
- Magna5: “Magna5 Cybersecurity Notification: Advance Notice of Critical PHP Vulnerabilities Pending Patch Release”
- Pantheon: “PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619”
- Scaleway: “[BookMyName][Security] Emergency maintenance - BMN services unavailable”
- Nutshell CRM: “PHP2Shell Response”
- Re:amaze: “PHP Security advisory: Critical remote code execution vulnerabilities”
- Omniaretail: “PHP security vulnerability, no impact on Omnia 2.0”
- Frisbii Media: “Limited functionality in Merchant Backend and Self Service”
- Linode: “Customer Security Advisory: PHP Remote Code Execution Vulnerabilities”
- Accrisoft: “Critical Software vulnerabilities”
- Pipedrive Marketplace: “Recent PHP Security Vulnerabilities: No Action Required”
- Auvik: “PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)”
- Ottomatic Cloud: “PHP Security Update - Identified”
- Stensul: “Resolved — Stensul service fully restored”
- Lightspeedhq: “Statement on PHP vulnerabilities”
- Kadence: “Temporary limitation on file uploads”
- Digistorm: “Outage Identified”
- ePraise: “Services Temporarily Offline for PHP Patching”
- Raptor Technologies: “PublicSchoolWORKS - PHP Vulnerability Update”
- iSpot: “PHP Security Vulnerabilities”
- Eptura: “Serraview Advisory: PHP Security Update and Planned Maintenance”
- Connectwise Manage: “Backup for Files Portal Unavailable: Security Precaution”
- Blackbaud: “Active Issue Alert – Blackbaud Education Management Solutions, Blackbaud eTapestry® - #000698846”
- Thrivelearning: “PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)”
- Acquia Optimize: “Acquia Cloud Platform management services temporarily unavailable”
- Cloudinary: “Notice regarding recently-reported PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619”
- Intiveo: “Intiveo Systems Responding to PHP2Shell”
- AudioEye: “PHP security vulnerabilities”
- Kombo: “Third-party API downtime following php2shell”
- Kinsta®: “PHP Security Vulnerability Update”
- RadarFirst: “RadarFirst statement on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell")”
- Float: “Security Maintenance – Infrastructure Component Update”
- Articulate: “Articulate Blog: Temporarily offline for maintenance”
- Cin7: “Cin7 ForesightAI will be temporarily unavailable while we patch the PHP vulnerability”
- Engaging Networks: “PHP Security Vulnerabilities”
- Vasion: “October 21, 2026: External Security Advisory Affecting Vasion Products (PHP Remote Code Execution Vulnerabilities and eMudhra Intermediate CA Compromise)”
- Huntress: “Curricula Simulated Phish Service is down.”
- Instructure: “PHP awareness”
- Chainguard: “Critical PHP vulnerabilities require updates”
- HubSpot: “Update on PHP security vulnerability”
- NavVis: “Security Update: PHP2Shell Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)”
- Medius: “Medius Security Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)”
- Amplience: “PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619)”
- Everway: “Security update: Global PHP vulnerabilities and Everway products”
- Supermetrics: “Security Advisory: PHP Vulnerabilities, October 21, 2026”
- Zapier: “Assessment of recently reported PHP vulnerabilities”
- Chargebee: “Subject: Security Notice: No Impact from PHPshell Zero-Day Vulnerability”
- Alloy: “Security Advisory Notice: Alloy Unaffected by Reported PHP Vulnerabilities”
- Astronomer: “PHP Security Advisory: Astro and Astro Private Cloud Not Affected; Review Custom Images”
How we catch these
Provider trouble: companies that rely on a provider name it on their own status pages within an hour: three of them, two naming the same cloud region, or two in a burst of incidents that the provider posts about too. It's going on until those companies have resolved their incidents, or it has been quiet for 12 hours.
Shared issues: five or more companies post about the same named thing within 48 hours, at least four times as often as usual. It's going on while posts keep coming, within 6 hours.