Resolved after 13 hours 21 minutes, affecting MyKinsta, on October 21, 2026.
All sites are protected, the PHP security updates have been rolled out across the platform, and we have no evidence of any breaches related to this vulnerability.
Affected components
Update timeline
- investigating Oct 21, 2026, 07:04 PM UTC
We're actively addressing the PHP security vulnerability announced by the PHP security team. As PHP is managed at the platform level on Kinsta, fixes will be deployed automatically once validated. The patched versions of PHP 8.3 and 8.5 have now been validated and are being rolled out across our platform. If your site is already using either version and you'd like to apply the patch immediately, you can switch to a lower PHP version and then back to your original version. Updates for PHP 8.4, 8.2, 8.1, and 7.4 are still undergoing validation and will be rolled out once ready. No action is required on your end. We'll provide further updates as the rollout progresses.
- investigating Oct 21, 2026, 08:20 PM UTC
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, and 8.0 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4, 8.2, 8.1, and 7.4 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
- investigating Oct 21, 2026, 09:17 PM UTC
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.0, and 7.4 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4, 8.2, and 8.1 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
- investigating Oct 21, 2026, 10:06 PM UTC
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.1, 8.0, and 7.4 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4 and 8.2 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
- investigating Oct 21, 2026, 11:25 PM UTC
The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.1, 8.0, 7.4, 8.2, and 8.4. Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
- investigating Oct 22, 2026, 01:31 AM UTC
The following PHP versions have patches that are rolling out across our infrastructure: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
- investigating Oct 22, 2026, 08:25 AM UTC
The following PHP versions have patches that are rolling out across our infrastructure: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.
- resolved Oct 22, 2026, 08:26 AM UTC
All sites are protected, the PHP security updates have been rolled out across the platform, and we have no evidence of any breaches related to this vulnerability.
Your product runs on more than Kinsta
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services