Seravo Outage History

Started Oct 21, 2026, 07:35 AM UTC· resolved Oct 22, 2026, 05:48 AM UTC

1. identified Oct 21, 2026, 07:35 AM UTC

   We're aware of critical PHP vulnerabilities announced at 2026-10-20. We're mitigating current known exploits, and work actively to apply security patches as soon as they are made available.

2. identified Oct 21, 2026, 08:19 AM UTC

   Initial mitigations have been applied to the sites. We continue to monitor the situation and apply further mitigations if needed. Security patches will be applied as soon as they're available.

3. identified Oct 21, 2026, 08:22 AM UTC

   As quick update: - initial mitigations have been applied to all customers, we keep monitoring the situation to apply any additional modifications if needed - we might need to temporarily restrict access to some features, we will notify about such changes separately - all PHP versions are affected - Seravo currently recommends PHP 8.3 or newer, please see https://help.seravo.com/en/articles/409537-available-php-versions for more details - upstream will provide patches at today 14:00 UTC+0, and we will start rolling out fixes as soon as update is available - upstream will provide patches for PHP 8.2 and newer versions at least initially

4. identified Oct 21, 2026, 09:18 AM UTC

   We're continuing in improving the mitigations and monitoring the situation. As far as we know, no current mitigation provides full protection. *Seravo will apply patches as soon as updated PHP versions will become publicly available.*

5. identified Oct 21, 2026, 11:01 AM UTC

   We are still working on the issue, initial mitigations in place for all customers. We expect upstream to provide patches at 17:00 (UTC+3). We've also received some questions about temporarily closing sites. Per customer request we can take site down temporarily, contact our customer service if interested ([email protected]). More on the topic: - Traficom: Kriittisiä haavoittuvuuksia PHP:ssa https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-37 (in Finnish) - YLE: Laajasti käytetyssä PHP-ohjelmointi­kielessä haavoittuvuuksia https://yle.fi/a/74-20252496 (in Finnish)

6. identified Oct 21, 2026, 02:23 PM UTC

   We've already been deploying the updated PHP versions for some time, due to large amount of update targets full update will take some time.

7. identified Oct 21, 2026, 04:40 PM UTC

   The PHP security updates are still ongoing. Thank you for your patience.

8. monitoring Oct 21, 2026, 09:34 PM UTC

   The PHP update has been applied and we're now monitoring how the situation develops.

9. resolved Oct 22, 2026, 05:48 AM UTC

   This incident has been resolved.

Read the full incident report →

Started Oct 06, 2026, 06:11 AM UTC· resolved Oct 06, 2026, 09:49 AM UTC

1. investigating Oct 06, 2026, 06:11 AM UTC

   We are currently investigating this issue.

2. monitoring Oct 06, 2026, 07:47 AM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Oct 06, 2026, 09:49 AM UTC

   This incident has been resolved.

4. postmortem Oct 07, 2026, 12:11 PM UTC

   ## DDoS attack at FI-Haarla On Tuesday, October 6, 2026, Seravo's server cluster FI-Haarla became a target of a large-scale DDoS attack. DDoS stands for Distributed Denial of Service, a malicious cyberattack that floods a server with overwhelming internet traffic to make it unresponsive and stop working for real users. The attack started at 9:00 \(UTC\+3\). During the attack most of the websites hosted in FI-Haarla experienced degraded service, but there was no other security threat to the sites. Visitors saw connection timeouts or HTTP502 errors when trying to visit the sites. The affected parties and relevant authorities have been informed, and no customer action is required. As part of our response, we encountered difficulties deploying the tools needed to mitigate the attack. We’ll review and improve our process to help prevent similar issues in future incidents. The attack ended at approximately 10:47, after which we continued to monitor the situation. The incident was marked as resolved on our end at 12:49. We apologize for the inconvenience caused by this attack. Seravo provides real-time updates on all disruptions at [status.seravo.com](http://status.seravo.com). We highly recommend subscribing to incident notifications via email, for example. ## Timeline \(UTC\+3\) * 09:00 DDoS starts * 09:02 DDoS detected, response initiated * 09:10 Blocks implemented * 09:31 More actions taken to mitigate the attack traffic * 10:00 Issue encountered in tooling, fixes implemented * 10:26 Tooling proves not to have the desired effect * 10:33 Further action to mitigate the attack * 10:47 Traffic suppressed, sites start recovering from DDoS

Read the full incident report →

Started Sep 21, 2026, 10:25 AM UTC· resolved Sep 21, 2026, 01:29 PM UTC

1. identified Sep 21, 2026, 10:25 AM UTC

   We identified a networking issue in cluster fi-ellington. Our team is working on it to fix it. We apologise for any inconvenience.

2. monitoring Sep 21, 2026, 12:04 PM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Sep 21, 2026, 01:29 PM UTC

   This incident has been resolved.

4. postmortem Sep 22, 2026, 10:05 AM UTC

   # Notice of a cluster outage on September 21, 2026 On Monday, September 21, 2026, we suffered from a partial outage on our server cluster FI-Ellington. The problem began at 13:15 \(UTC\+3\) and was completely resolved at 16:29. However, most of the sites remained to function until 14:20. Some sites were still needed to restart manually. The problem was related to a database service overload, affecting most of the websites hosted in the FI-Ellington cluster. The repair operations were unfortunately time-taking. Once the database service was fixed, we still needed to restart some of the site instances manually. To improve our processes for such possible issues in the future, we have implemented new tools to recover website instances faster. In addition, we have improved Seravo’s 24/7 monitoring in order to recognize issues of this type sooner. We apologize for the downtime and inconvenience caused by this incident. Seravo provides real-time updates on all disruptions at status.seravo.com. We highly recommend subscribing to incident notifications via email, for example. ## Timeline \(UTC\+3\) * 13:15 The first site alerts, investigation was started * 13:20 The issue was identified and limited to the database system * 13:25 Issue was reported on status.seravo.com * 13:50 Recovery measures * 14:20 The most sites were recovered * 14:20 Failed sites were identified and instance restarts initiated * 16:29 All sites recovered

Read the full incident report →

Started Sep 21, 2026, 10:16 AM UTC· resolved Sep 21, 2026, 12:03 PM UTC

1. identified Sep 21, 2026, 10:16 AM UTC

   We identified a networking issue in cluster fi-sestak. Our team is working on it to fix it. We apologise for any inconvenience.

2. resolved Sep 21, 2026, 12:03 PM UTC

   This incident has been resolved.

3. postmortem Sep 22, 2026, 10:06 AM UTC

   ## DDoS attack at FI-Sestak On Monday, June 21, 2026, Seravo's server cluster FI-Sestak became a target of a large-scale DDoS attack. DDoS stands for Distributed Denial of Service, a malicious cyberattack that floods a server with overwhelming internet traffic to make it unresponsive and stop working for real users. ‌ The attack started at 12:45 \(UTC\+3\). During the attack most of the websites hosted in FI-Sestak experienced degraded service, but there was no other security threat to the sites. Visitors received connection timeouts or HTTP502 errors while trying to visit the sites. ‌ At approximately 13:15, an incident occurred in another cluster, FI-Ellington, initially raising concerns that the incident might be related to the DDoS attack in FI-Sestak. No indication of a connection between the two incidents was found. However, the overlap temporarily diverted attention and delayed recovery of FI-Sestak. ‌ As a part of our response, we deployed new tooling to assist with mitigating an attack like this in the future. The tooling proved useful during the incident and will be retained in our toolkit for similar incidents in future. ‌ The attack ended at approximately 14:20, after which we continued to monitor the situation. The incident was marked as resolved on our end at 15:03. ‌ We apologize for the inconvenience caused by this attack. ‌ Seravo provides real-time updates on all disruptions at [status.seravo.com](http://status.seravo.com). We highly recommend subscribing to incident notifications via email, for example. ## Timeline \(UTC\+3\) * 12:45 DDoS starts * 12:49 First signs of abnormal web traffic * 12:55 First blocks deployed to mitigate the attack * 13:15 A simultaneous, unrelated issue in another server cluster slows down investigation * 13:45 New tooling deployed * 14:08 New tooling proves effective * 14:20 DDoS ends * 15:03 Incident marked as resolved

Read the full incident report →

Started Sep 09, 2026, 06:24 AM UTC· resolved Sep 09, 2026, 06:49 AM UTC

1. investigating Sep 09, 2026, 06:24 AM UTC

   We have noticed database connectivity problems in cluster fi-sestak. We are investigating the issue.

2. monitoring Sep 09, 2026, 06:36 AM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Sep 09, 2026, 06:49 AM UTC

   This incident has been resolved.

Read the full incident report →

Started Sep 07, 2026, 08:35 AM UTC· resolved Sep 07, 2026, 09:41 AM UTC

1. investigating Sep 07, 2026, 08:35 AM UTC

   We are currently investigating this issue.

2. monitoring Sep 07, 2026, 08:44 AM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Sep 07, 2026, 09:41 AM UTC

   This incident has been resolved.

Read the full incident report →

Started Sep 04, 2026, 11:58 AM UTC· resolved Sep 05, 2026, 06:49 AM UTC

1. monitoring Sep 04, 2026, 11:58 AM UTC

   We are currently experiencing delays in email delivery from WordPress sites to recipient addresses hosted by Microsoft (such as Outlook, Hotmail, and Office 365). Email delivery to all other mail providers is functioning normally. We are monitoring the situation closely and will update this notice as soon as normal delivery times resume.

2. resolved Sep 05, 2026, 06:49 AM UTC

   This incident has been resolved.

Read the full incident report →

Started Aug 11, 2026, 11:11 AM UTC· resolved Aug 11, 2026, 11:26 AM UTC

1. investigating Aug 11, 2026, 11:11 AM UTC

   We are currently investigating this issue.

2. resolved Aug 11, 2026, 11:26 AM UTC

   This incident has been resolved.

Read the full incident report →

Started Jun 27, 2026, 06:42 PM UTC· resolved Jun 27, 2026, 08:03 PM UTC

1. identified Jun 27, 2026, 06:42 PM UTC

   We identified a networking issue in cluster de-dauner. Our team is working on it to fix it. We apologise for any inconvenience.

2. identified Jun 27, 2026, 07:14 PM UTC

   We are continuing to work on a fix for this issue.

3. monitoring Jun 27, 2026, 07:36 PM UTC

   A fix has been implemented and we are monitoring the results.

4. resolved Jun 27, 2026, 08:03 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Jun 26, 2026, 08:53 PM UTC· resolved Jun 26, 2026, 09:51 PM UTC

1. investigating Jun 26, 2026, 08:53 PM UTC

   We are experiencing availability issues. Our team is actively investigating and resolving the situation. We apologise for any inconvenience. Thank you for your patience.

2. resolved Jun 26, 2026, 09:51 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Jun 25, 2026, 06:19 PM UTC· resolved Jun 25, 2026, 07:20 PM UTC

1. identified Jun 25, 2026, 06:19 PM UTC

   We identified a networking issue in cluster. Our team is working on it to fix it. We apologise for any inconvenience.

2. monitoring Jun 25, 2026, 07:07 PM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Jun 25, 2026, 07:20 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Jun 17, 2026, 07:06 AM UTC· resolved Jun 17, 2026, 07:36 AM UTC

1. investigating Jun 17, 2026, 07:06 AM UTC

   We have noticed database connectivity problems in cluster fi-tolonen. We are investigating the issue.

2. identified Jun 17, 2026, 07:09 AM UTC

   The issue has been identified and a fix is being implemented.

3. resolved Jun 17, 2026, 07:36 AM UTC

   This incident has been resolved.

Read the full incident report →

Started Jun 15, 2026, 01:36 PM UTC· resolved Jun 15, 2026, 07:25 PM UTC

1. monitoring Jun 15, 2026, 01:36 PM UTC

   Customers that have opted to use external DNS ( dns{1..4}triuvare-webhosting.fi) for their site might encounter availability issues with their sites. Incident does not affect customers using only Seravo-provided hosting services.

2. resolved Jun 15, 2026, 07:25 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Jun 10, 2026, 04:30 AM UTC· resolved Jun 10, 2026, 04:41 AM UTC

1. identified Jun 10, 2026, 04:30 AM UTC

   We are experiencing availability issues in cluster fi-haarla. Some websites may experience interruptions. Our team is actively investigating and resolving the situation. We apologise for any inconvenience. Thank you for your patience.

2. monitoring Jun 10, 2026, 04:36 AM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Jun 10, 2026, 04:41 AM UTC

   This incident has been resolved.

Read the full incident report →

Started Jun 09, 2026, 03:25 AM UTC· resolved Jun 09, 2026, 04:24 AM UTC

1. identified Jun 09, 2026, 03:25 AM UTC

   We identified a networking issue in cluster. Our team is working on it to fix it. We apologise for any inconvenience.

2. monitoring Jun 09, 2026, 04:23 AM UTC

   A fix has been implemented and we are monitoring the results.

3. monitoring Jun 09, 2026, 04:23 AM UTC

   We are continuing to monitor for any further issues.

4. resolved Jun 09, 2026, 04:24 AM UTC

   This incident has been resolved.

5. postmortem Jun 09, 2026, 10:18 AM UTC

   # Häiriö Suomessa sijaitsevissa palvelinklustereissa 9.6.2026 \(English follows\) Ubuntu-käyttöjärjestelmän kehittäjä Canonical julkaisi maanantaina 8.6.2026 korjauksen www-palvelinohjelmisto Nginx:n HTTP/2 Bomb -haavoittuvuuteen \([https://ubuntu.com/security/notices/USN-8398-1](https://ubuntu.com/security/notices/USN-8398-1)\). Nginx on käytössä myös Seravolla, ja ohjelmisto päivitettiin automaattisesti aamulla 9.6.2026. Päivityksessä oli mukana regressio, joka rikkoi Seravolla käytössä olevien Nginx-moduulien yhteensopivuuden, minkä seurauksena Nginx ei toiminut normaalisti eikä pystynyt vastaamaan HTTP-pyyntöihin. Ongelma on maailmanlaajuinen, eikä Canonical ole toistaiseksi julkaissut päivityksiä ko. moduuleihin. Seravolla ongelma vaikutti suurimpaan osaan asiakkaidemme sivustoja Suomessa sijaitsevissa palvelinklustereissa, ja sen seurauksena sivustot eivät toimineet. Ongelma ei koskenut sivustoja palvelinklustereissamme, jotka sijaitsevat muissa maissa \(Ruotsi, Saksa, Yhdysvallat\). Ongelma saatiin korjattua palauttamalla väliaikaisesti käyttöön Nginx:n aiempi versio. Seuraamme saatavilla olevien korjausten tilannetta ja teemme tarvittavat päivitykset mahdollisimman pian. Ilmoitamme reaaliaikaisesti kaikista palveluitamme koskevista häiriöistä erillisellä statussivulla osoitteessa status.seravo.com. Suosittelemme häiriöilmoitusten tilaamista esim. sähköpostiin. ## Aikajana \(UTC\+3\) * 06:00 Päivitykset alkoivat * 06:13 Ensimmäinen sivustohälytys * 06:15 Seravon päivystäjä tarkistaa tilanteen * 06:21 Ongelma rajataan Nginx:ään * 06:25 Häiriöilmoitus julkaistaan \(status.seravo.com\) * 06:30 Ongelma rajataan ohjelmistopäivityksiin * 06:44 Päivystäjä eskaloi ongelman tiimin sisällä * 06:53 Käyttöön palautetaan aiempi Nginx-versio * 07:12 Kaikkien palvelimien Nginx palautettu, sivustot toiminnassa * 07:18 Ongelman leviäminen laajemmalle estetty # Incident on Finnish server clusters on June 9, 2026 On Monday, June 8, 2026, Canonical \(developer of the Ubuntu operating system\) released a security patch for the Nginx web server software to address the HTTP/2 Bomb vulnerability \([https://ubuntu.com/security/notices/USN-8398-1](https://ubuntu.com/security/notices/USN-8398-1)\). Nginx is used by Seravo, and the software was automatically updated on the morning of June 9, 2026. The patch contained a regression that broke compatibility with the Nginx modules used by Seravo. As a result, Nginx failed to handle incoming HTTP requests. The issue affects systems globally, and Canonical has not yet released updates for the affected modules. At Seravo’s hosting, the issue affected the majority of our customers’ sites hosted on server clusters located in Finland, causing downtime. Sites hosted on our server clusters in other countries \(Sweden, Germany, and the United States\) were not affected. The issue was resolved by temporarily rolling back to the previous version of Nginx. We are closely monitoring the availability of official fixes and will apply the necessary updates as soon as possible. Seravo provides real-time updates on all disruptions at status.seravo.com. We highly recommend subscribing to incident notifications via email, for example. ## Timeline \(UTC\+3\) * 06:00 Updates begin * 06:13 First site alert triggered * 06:15 Seravo’s on-call expert investigates the situation * 06:21 The issue is isolated to Nginx * 06:25 Incident notification published \(status.seravo.com\) * 06:30 The issue is limited to software updates * 06:44 On-call expert escalates the issue within the team * 06:53 Nginx is rolled back to previous version * 07:12 Nginx rollback on all servers successful, sites back in operation * 07:18 Issue successfully mitigated, further propagation prevented

Read the full incident report →

Started May 05, 2026, 09:39 PM UTC· resolved May 06, 2026, 04:01 AM UTC

1. investigating May 05, 2026, 09:39 PM UTC

   Due to a fault, there is currently limited availability to the recursive DNS resolution for "de" domains. This might affect some of our customers. More info here: https://status.hetzner.com/incident/c5e4ec2e-82b5-4f1a-a7ce-37127a6f2aa9

2. resolved May 06, 2026, 04:01 AM UTC

   This incident has been resolved.

Read the full incident report →

Started Mar 25, 2026, 11:22 AM UTC· resolved Mar 25, 2026, 11:40 AM UTC

1. identified Mar 25, 2026, 11:22 AM UTC

   We identified a networking issue in cluster us-davis. Our team is working on it to fix it. We apologise for any inconvenience.

2. monitoring Mar 25, 2026, 11:25 AM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Mar 25, 2026, 11:40 AM UTC

   This incident has been resolved.

Read the full incident report →

Started Mar 12, 2026, 03:45 PM UTC· resolved Mar 12, 2026, 04:18 PM UTC

1. investigating Mar 12, 2026, 03:45 PM UTC

   We are currently investigating this issue.

2. resolved Mar 12, 2026, 04:18 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Mar 12, 2026, 03:10 AM UTC· resolved Mar 12, 2026, 07:47 AM UTC

1. investigating Mar 12, 2026, 03:10 AM UTC

   We are currently investigating this issue.

2. identified Mar 12, 2026, 04:33 AM UTC

   The issue has been identified and a fix is being implemented.

3. monitoring Mar 12, 2026, 06:21 AM UTC

   A fix has been implemented and we are monitoring the results.

4. resolved Mar 12, 2026, 07:47 AM UTC

   This incident has been resolved.

5. postmortem Mar 13, 2026, 09:37 AM UTC

   # Notice of a Server Outage on March 12, 2026 On Thursday March 12, 2026, a failure related to the server resource usage caused an outage in the cluster fi-perko. The outage was caused by a newly implemented security feature which led to increased resource usage. Monitoring failed to notice and pinpoint the increased resource usage in time, which led to the outage. The outage was aggravated by an unrelated networking change which led to delay in recovery. This caused an outage to all sites in the fi-perko cluster. The problem was noticed immediately by our on-call monitoring processes, and measures were immediately implemented to begin recovery. The disruption first began at 04:00 \(UTC\+2\), escalated at 05:00 and ended at 08:19 \(UTC\+2\). We apologise for any inconvenience caused by the disruption. ## Timeline \(all timestamps UTC\+2 \(EET\)\) * 12.3.2026 03:47 Partial outage * 12.3.2026 03:52 On-call performs initial recovery measures * 12.3.2026 04:00 Recovered from partial outage * 12.3.2026 05:00 Incident escalated again * 12.3.2026 05:10 On-call attempts recovery measures * 12.3.2026 05:15 Full outage * 12.3.2026 05:27 On-call performs recovery measures * 12.3.2026 06:17 Recovered from the outage - begin site recovery * 12.3.2026 08:19 All affected sites were back online ## Follow-Up Action As a result of the incident, we at Seravo have identified the need for the following measures: * Testing new features with extended data-sets to be able to catch issues caused by the sheer volume of processed data * Improvements to system resource monitoring

Read the full incident report →

Started Mar 05, 2026, 03:08 PM UTC· resolved Mar 05, 2026, 06:59 PM UTC

1. identified Mar 05, 2026, 03:08 PM UTC

   We identified an upstream service provider networking issue causing slowness on some sites. We apologise for any inconvenience.

2. identified Mar 05, 2026, 04:01 PM UTC

   We are continuing to work on a fix for this issue.

3. identified Mar 05, 2026, 04:24 PM UTC

   The problem is related to Meta API services that slow down the sites. The sites will remain to work normally after the issue is fixed by the service provider.

4. monitoring Mar 05, 2026, 05:36 PM UTC

   A fix has been implemented and we are monitoring the results.

5. resolved Mar 05, 2026, 06:59 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Feb 25, 2026, 09:00 PM UTC· resolved Feb 25, 2026, 09:00 PM UTC

1. resolved Mar 05, 2026, 09:56 AM UTC

   On February 25 between 23:04–23:11, a short networking incident affected a portion of our customers. The disruption was caused by an issue at our data center provider related to an ongoing cyberattack. Due to the short duration and nature of the incident, it was not immediately reflected on our status page. https://status.hetzner.com/incident/5e901309-0873-42af-90c5-84f38304f592

Read the full incident report →

Started Feb 17, 2026, 02:06 PM UTC· resolved Feb 17, 2026, 02:11 PM UTC

1. identified Feb 17, 2026, 02:06 PM UTC

   We are experiencing availability issues. Our team is actively investigating and resolving the situation. We apologise for any inconvenience. Thank you for your patience.

2. resolved Feb 17, 2026, 02:11 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Feb 06, 2026, 01:18 PM UTC· resolved Feb 06, 2026, 04:23 PM UTC

1. investigating Feb 06, 2026, 01:18 PM UTC

   We are currently investigating this issue.

2. resolved Feb 06, 2026, 04:23 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Feb 06, 2026, 06:23 AM UTC· resolved Feb 06, 2026, 03:46 PM UTC

1. identified Feb 06, 2026, 06:23 AM UTC

   We are under an active DDoS campaign and we are mitigating the issue. All the data is safe. If the campaign is related to a specific domain or web site, we are in contact with the customer in question separately.

2. monitoring Feb 06, 2026, 09:58 AM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Feb 06, 2026, 03:46 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Feb 03, 2026, 01:13 PM UTC· resolved Feb 03, 2026, 02:01 PM UTC

1. investigating Feb 03, 2026, 01:13 PM UTC

   We are currently investigating this issue.

2. monitoring Feb 03, 2026, 01:55 PM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Feb 03, 2026, 02:01 PM UTC

   This incident has been resolved.

Read the full incident report →