23 October

4.00pm - Security progress update and scheduled maintenance notice

Our teams have continued to work through deployments and co-ordinate updates across all customer environments following the PHP vulnerability patch release yesterday (Thursday) morning.

What we’ve done

• Code Care and Retainer customers: All active Code Care and retainer customer environments have been successfully patched.

• Bespoke projects: All active bespoke customer environments currently managed by our teams are fully patched and secured.

• Completed deployments: Full deployments have been completed across all environments for customers who had not yet updated. These redeployments include the PHP patch without uplifting the platform manifest version.

Upcoming scheduled maintenance

Now that the patch deployments are complete, secure, and stable, we will return Silverstripe Cloud Dashboard capacity back to its normal operational size.

This means the Dashboard will be unavailable for approximately 15 minutes on Wednesday 28 October between 7:00am and 8:00am NZDT.

During this brief window, deployment actions via Dash will be temporarily unavailable. Your hosted websites and applications will not be affected and will remain fully online.

We appreciate your continued patience and your partnership as we’ve completed these final updates.

Ngā mihi maioha.

22 October

4.58pm - End-of-day progress report

Our highest priority is ensuring the stability and security of our clients’ sites. Since yesterday’s announcement of two critical PHP vulnerabilities, our teams have worked overnight and throughout today to put protections in place, make patches available, and co-ordinate updates across customer environments.

What we’ve done

• Made patched PHP packages available on Silverstripe Cloud shortly after the 3am NZDT release.
• Confirmed WAF protection against known exploitation patterns for environments covered by Silverstripe’s WAF service.
• Increased deployment Dashboard resources and capacity to support the volume of updates.
• Published deployment instructions, including how to apply the PHP update separately from the Silverstripe Cloud Email Integration changes.

What we’re continuing to do

Our teams are progressing deployments for Professional Services and Code Care customers, testing application functionality and tracking outstanding environments. Within agreed customer priorities, we are prioritising environments without confirmed WAF protection, including publicly accessible non-production sites.

Our security monitoring partner continues to monitor covered production and non-production environments and will alert us to detected indicators of compromise or persistent exploitation attempts.

What you need to do

• If Silverstripe manages your application: our team is co-ordinating the required work and will contact you if your input is needed.
• If you use an external development agency or internal team: please ensure they arrange a full deployment of each affected environment. The update is not applied automatically, and WAF protection does not replace patching.
• If you run PHP 8.1 or earlier, or need assistance: contact your development team or raise a Service Desk ticket to agree the appropriate remediation.
• For publicly accessible non-production environments without a WAF: enable the IP whitelist in the Dashboard to restrict access while arranging the update.

The immediate protections and patching process are in place. Our focus is now on completing the remaining deployments and supporting customers through that work.

We will continue tracking progress and sharing material updates.

We appreciate your continued patience, and for working with us to keep your sites secure. Ngā mihi maioha. 

2.07pm - Cloud Access restored

Silverstripe Cloud access has been restored. You can now login and begin deploying the PHP update. 

Please refer to our earlier 5.10am update for the steps to take, and thank you again for your continued patience. 

We will provide another progress update shortly after 5pm today. 

1.27pm - Cloud access restoration

We estimate Silverstripe Cloud access will be restored between 2—2.30pm, with increased server resources to meet demand and further safeguard our clients' stability and security.

Thank you once again for your patience while we carry out these enhancements.

1.15pm -  Security monitoring for PHP exploitation

As part of our response to the PHP vulnerabilities, our security monitoring partner continues to monitor security events across environments covered by our SIEM service, including production and non-production environments. If they detect indicators of compromise or persistent attempts to exploit these vulnerabilities, they alert Silverstripe so we can immediately investigate and respond.

For environments covered by our WAF service, protection against known PHP exploitation patterns is also in place. These safeguards support our response while we coordinate deployment of the PHP security updates.

12.15pm - Update: our response and your next steps

We have emailed a detailed update to all clients outlining what we've done so far, and what needs doing next.

Patches are live on Silverstripe Cloud, and sites covered by our WAF service have active protection against known exploitation patterns.

If your site is supported by Silverstripe Professional Services, this work is being done by us and is covered under your existing arrangement at no additional cost.

Cloud clients working with internal developers or external agencies, because your application is maintained by other parties, they will need to perform compatibility checks and run a full deployment. We have provided details on recommended action. 

Please check your inbox for environment-specific next steps, or reach out to your Client Lead.

Ngā mihi anō. 

11.45am - Dashboard estimated completion

Deployment for Silverstripe Cloud Dashboard is still underway, and estimated to complete within the next 30 minutes.

Thank you for your continued patience.

9.50am - Dashboard briefly unavailable

We are significantly increasing server resources to meet demand and safeguard our clients' stability and security. In order to carry out these enhancements, we will be taking the Silverstripe Cloud Dashboard offline for a short time. 

For our customers with WAF, please be assured, it is in place and providing protection. Please see our earlier message on this. 

Thank you for your continued patience.

5.10am - Action required

• Patched PHP packages are now available on Silverstripe Cloud.
• Customers running PHP 8.2–8.5 must complete a full deployment of each affected environment to apply them.
• Customers running older PHP versions should urgently contact their development team or support provider.
• Below is further background, and the steps you need to take. 

Please note if you are one of our Professional Services or Code Care clients, as part of our service to you, we will be performing the following steps for you. 

If you are not a Professional Service or Code Care client and you do not have someone to support you with this deployment, please raise a Service Desk ticket, and we will endeavour to help; standard rates will apply.  

PHP security vulnerabilities and fixes

The PHP security team has released fixes for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities rated CVSS 9.2. These affect PHP’s handling of memory exhaustion and internal state between requests, potentially allowing an attacker to execute code without authentication.

The vulnerabilities affect the PHP runtime underlying websites and applications, including those using PHP-FPM. Updating Silverstripe CMS alone does not apply these fixes.

• Customers should apply the security release for their existing supported PHP branch.
  
  
• Moving to PHP 8.5 is not required.
  
  
• Some hosting and operating system vendors may provide packages containing backported fixes.

Customers running older PHP versions

• PHP 8.1 and earlier are outside normal upstream support.
  
  
• PHP has exceptionally provided minimal source patches for PHP 7.4, 8.0 and 8.1, and some vendors provide backported fixes. These do not restore ongoing support for those versions.
  
  
• Further technical information is available in the official PHP security advisory.
  
  
• If your environment uses an older PHP version, please work with your development team or support provider urgently to confirm a validated patched build or arrange an upgrade.
  
  Do not assume a routine deployment will resolve the issue.

WAF protection

• Customer environments with a Silverstripe Web Application Firewall (WAF) service have protection against known exploitation patterns. This provides an additional layer of protection and does not replace the need to apply PHP updates.
  
  
• Customers using their own WAF should confirm coverage with their provider.
  
  
• Publicly accessible environments without a WAF require urgent attention. This includes UAT, staging and test environments running affected PHP versions. These environments may be exposed to exploitation, even if they are not intended for public use.
  
  
• Apply the PHP security update as soon as possible. While arranging deployment, we strongly recommend enabling the IP whitelist in the Dashboard to restrict access to approved IP addresses on non-production environments. This reduces exposure but does not replace patching.

How to deploy the PHP update on Silverstripe Cloud

The updated PHP packages are now available on Silverstripe Cloud, but a full deployment is required to apply them to each environment. Existing environments are not automatically patched.

Step #1. Start a deployment

• In the Dashboard, open the relevant project and environment, then start a deployment.

Step #2. Select your release

• Select the branch, tag or commit you intend to deploy. If no application code changes are required, select Redeploy the current version on this environment.

Step #3. Configure a full deployment

• Select Show advanced options, then tick:
  • Backup database before deploying
  • Force full deployment
• Leave Force code-only deployment unticked, as it will not apply the PHP runtime update.

Have you completed the Silverstripe Cloud Email Integration set-up?

Manifest Version 5.11.0 changes the Silverstripe Cloud email sending service. If you use this service and have not yet configured your email domains, deploying the new Manifest may affect email delivery, including password resets and public form submissions.

• If set-up is incomplete, also tick Skip infrastructure version upgrade. This allows you to apply the PHP security update while deferring the Manifest changes.
• If set-up is complete, you do not need to skip the infrastructure upgrade for this reason. If you use a third-party email sending service, the Email Integration changes do not affect those emails.
• Leave the other advanced options unticked.

• The screenshot shows the settings for a deployment that defers the Manifest upgrade.
  
  
• Test in UAT before repeating the process for production.

Step #4. Review and deploy

• Review the deployment plan, complete the approval steps and proceed with the deployment.
  
  
• After deployment, test key functionality, including CMS access, public forms, uploads and email delivery. Once testing is complete in UAT, repeat the full deployment process for production and any other affected environments.
  
  
• If you deferred the Manifest upgrade, complete the Silverstripe Cloud Email Integration set-up as soon as possible, then arrange deployment of the latest Manifest. Remaining on an older Manifest is not a long-term solution.

Need assistance?

Please raise a Service Desk ticket, including your project, target environment, branch or release reference, preferred deployment window, and whether you need to defer the Manifest upgrade.

We continue to monitor the situation closely and will publish further updates on this page.

3.55am - Cloud Access restored

Silverstripe Cloud access has been restored.

3.45am - Security release update

Following the publication of the PHP security release, we are working to provide comprehensive information regarding these vulnerabilities, the protections in place, and any additional recommended actions for customers. Protecting our customers remains our highest priority.

For customers with a Silverstripe Web Application Firewall (WAF) service, protection against known exploitation patterns is in place. This provides an additional layer of protection while PHP updates are assessed and deployed. It does not replace the need to apply those updates.

Our teams are continuing to closely monitor the situation. We will continue to update here. 

21 October

4.40pm - Scheduled release on 22 Oct and patching plan

The PHP security team has scheduled a security release for the early hours of Thursday 22 October 2026 (New Zealand time). Full details, including affected versions and available patches, are expected with the release.

Our team will be actively monitoring the release and preparing to assess and test the patches as soon as they become available. Safeguarding the security and stability of our clients' sites is our number one priority. 

We will continue to provide updates on the situation, along with our response, and any actions required from you on this page. 

Ngā mihi. 

3.04pm - Dashboard unavailability

In light of the PHP vulnerabilities announced today, we have taken Silverstripe Cloud Dashboard offline to minimise potential impact. Additionally, this means the Silverstripe Search dashboard and Graylog are unavailable. 

To raise a ticket, please use ops@silverstripe.com(opens in new tab) which is being actively monitored by our Platform Support team.

Thank you for your continued patience.

2.58pm - PHP security announcement and upcoming patches

We are aware of the upcoming security patch for critical PHP vulnerabilities announced today. Our number one priority is the security and stability of our clients' sites. Our team is actively monitoring the release and is prepared to test and apply the fix as soon as it becomes available. We will notify all impacted customers as soon as the patches are released and assessed. 

• PHP's official statement on the critical security release
• Additional background information

Please reach out to your Client Lead if you have any questions.

Thank you for your patience.