Pantheon outage, 21 October 2026
PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619
- Started
- Resolved
- 22 Oct 2026, 16:36 UTC (after 26 h 32 min)
- Impact
- Not stated
- Affected
- Customer Sites
Is this still happening?
No. Pantheon marked this incident resolved on 22 Oct 2026, 16:36 UTC, 26 h 32 min after it began.
Right now: Pantheon reports all systems operational. (as of 26 Oct, 03:47 UTC) Live Pantheon status
Last update from Pantheon
Overnight monitoring continues to show persistent but limited probing, which is being blocked. Our rollout of updated PHP images across customer environments including LTS versions was complete as of 5pm Pacific time yesterday. We will continue to observe and may provide further analysis of our findings, but we are closing this incident.
Similar Pantheon incidents
Earlier incidents with the same affected part or wording - useful to see how long this kind of problem usually takes.
-
, resolved
-
, resolved after 29 h 18 min
-
, resolved after 5 h 17 min
Database Connection Issues and 504 Errors on a Subset of Sites
-
, resolved after 5 days
Security Advisory: Malicious Activity Affecting Platform Hosts
-
, resolved after 3 days
Security Advisory: Unauthorized Access to Customer Accounts via a Look-alike Sign-in Page