# \[RESOLVED\] Passbolt Cloud temporarily offline & PHP critical vulnerability **URL:** \ **Category:** Announcements\ **Created:** [October 21, 2026, 12:57pm UTC](https://community.passbolt.com/t/resolved-passbolt-cloud-temporarily-offline-php-critical-vulnerability/14841 "2026-10-21T12:57:49Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![cedric](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/cedric/32/3868_2.png) [@cedric](https://community.passbolt.com/u/cedric)\ **Post date:** [October 21, 2026, 12:57pm UTC](https://community.passbolt.com/t/resolved-passbolt-cloud-temporarily-offline-php-critical-vulnerability/14841/1 "2026-10-21T12:57:49Z")
Hello, Yesterday, the PHP security team announced fixes for two critical vulnerabilities in PHP, to be released today at 14:00 UTC. [CERT-EU’s advisory](https://cert.europa.eu/publications/security-advisories/2026-018) indicates they could allow unauthenticated remote code execution. No technical details will be public until the release of the patches. **Passbolt Cloud** We applied every mitigation available and we see no trace of exploitation on Passbolt Cloud. But with the scope of the vulnerabilities still unknown, we decided to go further and decided to switch Passbolt Cloud offline until the patch is released and deployed on our infrastructure. This follows CERT-EU’s recommendation to isolate internet-facing applications until a fix is available. We know this is disruptive, and we didn’t take the decision lightly. A few hours without access is a better outcome than any risk to your data. Follow the restoration live on our [incident page](https://passboltstatus.com/). **If you self-host Passbolt** Your server runs PHP, so you’re concerned too. We recommend reading [CERT-EU’s advice](https://cert.europa.eu/publications/security-advisories/2026-018), checking which PHP version your instance runs on, and confirming whether it’s affected once PHP publishes the details. Note that PHP 8.1 and older won’t receive a fix. On our side, we’ll publish updated Docker images, DigitalOcean and OVA as soon as they’re ready. Update will follow on our [incident page](https://passboltstatus.com/). Thank you for your understanding, ---
**Author:** ![cedric](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/cedric/32/3868_2.png) [@cedric](https://community.passbolt.com/u/cedric)\ **Post date:** [October 21, 2026, 12:58pm UTC](https://community.passbolt.com/t/resolved-passbolt-cloud-temporarily-offline-php-critical-vulnerability/14841/2 "2026-10-21T12:58:07Z")
---
**Author:** ![Vivien](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/vivien/32/1740_2.png) [@Vivien](https://community.passbolt.com/u/Vivien)\ **Post date:** [October 21, 2026, 2:10pm UTC](https://community.passbolt.com/t/resolved-passbolt-cloud-temporarily-offline-php-critical-vulnerability/14841/3 "2026-10-21T14:10:03Z")
The PHP security team has released the patch for CVE-2026-109618 and CVE-2026-109619. The team is now updating Passbolt Cloud and the self-hosted images (Docker, OVA, DigitalOcean). Passbolt Cloud will be restored once the update is deployed and verified. ---
**Author:** ![Vivien](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/vivien/32/1740_2.png) [@Vivien](https://community.passbolt.com/u/Vivien)\ **Post date:** [October 21, 2026, 2:33pm UTC](https://community.passbolt.com/t/resolved-passbolt-cloud-temporarily-offline-php-critical-vulnerability/14841/4 "2026-10-21T14:33:01Z")
Linux distributions are publishing patched PHP packages. Self-hosted administrators using Passbolt’s distribution packages can update PHP on their servers. The fixed versions are listed on [php.net](http://php.net). ---
**Author:** ![Vivien](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/vivien/32/1740_2.png) [@Vivien](https://community.passbolt.com/u/Vivien)\ **Post date:** [October 21, 2026, 3:17pm UTC](https://community.passbolt.com/t/resolved-passbolt-cloud-temporarily-offline-php-critical-vulnerability/14841/5 "2026-10-21T15:17:59Z")
Patched Docker images, AWS AMI and OVA are now published. Docker users can pull the latest image and redeploy. For existing AMI and OVA instances, update PHP through your system’s package manager: a new image only applies to new deployments. DigitalOcean images are awaiting marketplace review, and the Helm chart update is in progress. ---
**Author:** ![Vivien](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/vivien/32/1740_2.png) [@Vivien](https://community.passbolt.com/u/Vivien)\ **Post date:** [October 21, 2026, 3:35pm UTC](https://community.passbolt.com/t/resolved-passbolt-cloud-temporarily-offline-php-critical-vulnerability/14841/6 "2026-10-21T15:35:26Z")
Access to cloud service is restored. ---
**Author:** ![cedric](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/cedric/32/3868_2.png) [@cedric](https://community.passbolt.com/u/cedric)\ **Post date:** [October 21, 2026, 4:14pm UTC](https://community.passbolt.com/t/resolved-passbolt-cloud-temporarily-offline-php-critical-vulnerability/14841/7 "2026-10-21T16:14:59Z")
To wrap up: our review of Passbolt Cloud’s system logs found no evidence of exploitation, and we continue to monitor our infrastructure. If you self-host Passbolt and haven’t updated PHP yet, please do it now. The [incident page](https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2) gathers everything in one place: the details published by PHP, the fixed versions, how to update each type of installation, and the status of each Passbolt image. Thanks everyone for your patience. ---
**Author:** ![cedric](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/cedric/32/3868_2.png) [@cedric](https://community.passbolt.com/u/cedric)\ **Post date:** [October 22, 2026, 6:41am UTC](https://community.passbolt.com/t/resolved-passbolt-cloud-temporarily-offline-php-critical-vulnerability/14841/8 "2026-10-22T06:41:01Z")
---
**Author:** ![Phiba](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/phiba/32/1784_2.png) [@Phiba](https://community.passbolt.com/u/Phiba)\ **Post date:** [October 23, 2026, 7:45am UTC](https://community.passbolt.com/t/resolved-passbolt-cloud-temporarily-offline-php-critical-vulnerability/14841/9 "2026-10-23T07:45:32Z")
If you want more details on the incident, and the steps self-hosted users should take to update their PHP installations, check out the blog [PHP2Shell Incident, What Should I Do](https://www.passbolt.com/blog/php2shell-incident-what-should-i-do)