Kinsta outage, October 2026: PHP Security Vulnerability Update

Kinsta reported and resolved an incident: PHP Security Vulnerability Update. It lasted 13.4 hours.

Resolved

From Kinsta's official status page, in their words.

What happened

Started
Resolved
Duration
13.4 hours
Impact
none
Affected
MyKinsta

Why it happened

Kinsta has not given a cause in its updates. We never guess one.

This incident on the Kinsta status page

Timeline

Newest first. From Kinsta's official status page, in their words.

  1. resolved

    All sites are protected, the PHP security updates have been rolled out across the platform, and we have no evidence of any breaches related to this vulnerability.

  2. investigating

    The following PHP versions have patches that are rolling out across our infrastructure: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

  3. investigating

    The following PHP versions have patches that are rolling out across our infrastructure: 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

  4. investigating

    The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.1, 8.0, 7.4, 8.2, and 8.4. Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

  5. investigating

    The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.1, 8.0, and 7.4 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4 and 8.2 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

  6. investigating

    The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, 8.0, and 7.4 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4, 8.2, and 8.1 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

  7. investigating

    The following PHP versions have patches that are rolling out across our infrastructure: 8.5, 8.3, and 8.0 The following PHP versions are still undergoing validation and will be rolled out once ready: 8.4, 8.2, 8.1, and 7.4 Our Cloudflare firewall mitigations and local configuration changes to block potential exploits of these vulnerabilities are remaining in place for all sites regardless of patch status until further notice.

  8. investigating

    We're actively addressing the PHP security vulnerability announced by the PHP security team. As PHP is managed at the platform level on Kinsta, fixes will be deployed automatically once validated. We do want to clarify that the attacks are being successfully mitigated by our Cloudflare site protections, across all our sites, based on rules created specifically for these vulnerabilities. We continue to maintain multiple comprehensive levels of security to mitigate any potential attacks. The patched versions of PHP 8.3 and 8.5 have now been validated and are being rolled out across our platform. If your site is already using either version and you'd like to apply the patch immediately, you can switch to a lower PHP version and then back to your original version. Updates for PHP 8.4, 8.2, 8.1, and 7.4 are still undergoing validation and will be rolled out once ready. No action is required on your end. We'll provide further updates as the rollout progresses.

What this means for a business (and what to check now)

  • Retry anything that failed during the 13.4 hours.
  • Enter any payments, bookings or jobs you took another way.
  • If a deadline fell inside the window, keep this page as your record of the outage.

The full guide: what to do when a service you rely on is down

Other Kinsta incidents

Hear about the next Kinsta incident as it starts

Free email alerts when the official status changes, with what to do while it is down.

Watch Kinsta