Scaleway Status

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are currently experiencing degraded performance with it-mil APIs. Some requests may see elevated latency, intermittent errors, or timeouts. Our engineering team is actively investigating the issue and working to restore normal service as quickly as possible.

Resolved: This incident has been resolved.

Investigating: Due to an abnormal charge, some Scaleway product logs might have been ingested with delay and some might have been dropped

We observe some drop on Serverless logs

This issue is now resolved

Resolved: This incident has been resolved.

Investigating: We added other impacted products and we are still investigating.

Investigating: We are continuing to investigate this issue.

Investigating: We are currently observing an increased rate of 5xx errors on the container registry in the fr-par region. Some image push and pull operations may fail or experience delays. Our teams are actively investigating, and we will provide an update as soon as more information is available.

Resolved: This incident has been resolved.

Investigating: We are continuing to investigate this issue.

Investigating: Since 14:51 UTC, new RDB instance can't be provisioning in AMS

Resolved: The global incident is now solved. If you still experience issues, please reach out our support through usual means.

Monitoring: Updates had piled up, causing these issues.

It has now been resolved.

Investigating: Several reports of inconsistencies in the zones between our DNS servers s0.dom.scw.cloud and s1.dom.scw.cloud

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: This incident has been resolved.

Identified: The issue has been identified and a fix is being implemented.

Monitoring: New deployment creation is temporarily unavailable due to infrastructure capacity constraints. Existing deployments are unaffected. We've identified the situation.

Resolved: This incident has been resolved.

Investigating: Since 7 pm, dedicated deployment deletion has been failing. Re-creation after deletion will remain impossible until the incident is resolved.

Resolved: Some requests to the deepseek-v4.1-flash model had experienced elevated timeouts. The situation has been resolved.

Monitoring: Some requests to the deepseek-v4-flash and deepseek-v4.1-flash models had experienced elevated timeouts. The error rates are improving. We're monitoring the situation.

Investigating: [10:06] Requests on model had experienced elevated timeouts. [10:15] Model has been unavailable [10:50] Fix has been applied

Resolved: This incident has been resolved.

Investigating: We added other impacted products and we are still investigating.

Investigating: We are continuing to investigate this issue.

Investigating: We are currently observing an increased rate of 5xx errors on the container registry in the fr-par region. Some image push and pull operations may fail or experience delays. Our teams are actively investigating, and we will provide an update as soon as more information is available.

Resolved: This incident has been resolved.

Investigating: We added other impacted products and we are still investigating.

Investigating: We are continuing to investigate this issue.

Investigating: We are currently observing an increased rate of 5xx errors on the container registry in the fr-par region. Some image push and pull operations may fail or experience delays. Our teams are actively investigating, and we will provide an update as soon as more information is available.

Investigating: 2026-10-26 11:40:37 GMT+1: a new image was released for Kapsule nodes, unfortunately the release seems to be only partial and some regions might not have the right image id. This may cause nodes to be unable to spawn.

Resolved: This incident has been resolved.

Investigating: We added other impacted products and we are still investigating.

Investigating: We are continuing to investigate this issue.

Investigating: We are currently observing an increased rate of 5xx errors on the container registry in the fr-par region. Some image push and pull operations may fail or experience delays. Our teams are actively investigating, and we will provide an update as soon as more information is available.

Resolved: This incident has been resolved.

Investigating: [12:00] Serverless Container creation is currently unavailable in it-mil due to communication issues within the Kubernetes cluster.

Resolved: This incident has been resolved.

Investigating: We added other impacted products and we are still investigating.

Investigating: We are continuing to investigate this issue.

Investigating: We are currently observing an increased rate of 5xx errors on the container registry in the fr-par region. Some image push and pull operations may fail or experience delays. Our teams are actively investigating, and we will provide an update as soon as more information is available.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.

PHP

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).

Actions taken:

• Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
• Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).

Impact for you:

• PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
• If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.

Node.js

Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.

If you experience any issue, please contact our support team.

We apologize for any inconvenience and thank you for your patience.

Identified: [Update] Security Maintenance – Web Hosting Services

Classic Shared Hosting / Mutu (Back online): Patched PHP versions (5.6, 7.0, 7.1, 7.2 and 7.3) have been fully deployed across all Classic shared hosting environments, and maintenance mode has been lifted. Websites are back online, except PHP 4 which remains in maintenance.

Current behavior per PHP version:

 -PHP 7.x: websites are served normally on their patched PHP version.
 -PHP 5.x: websites previously running PHP 5.2, 5.4 or 5.5 have been automatically migrated to PHP 5.6 (patched) and are served normally. We recommend that customers check that their websites are working correctly after this version change, following the recommendations in this guide: https://www.scaleway.com/en/docs/webhosting/reference-content/php-5-6-migration-guide/
 -PHP 4: websites remain in maintenance and are served a maintenance page. Customers can bring their websites back online by migrating to PHP 5.6 or later.

We apologize for the inconvenience, and thank you for your patience.

Identified: [Update] Security Maintenance – Web Hosting Services

Security patching for the php2shell vulnerability is progressing:

cPanel Environments (Resolved): PHP versions have been updated across all Scaleway and Online.net cPanel servers (as well as Scaleway Plesk). Maintenance mode has been lifted, and services are back online.

Classic Shared Hosting / Mutu (In Progress): Classic shared environments remain under maintenance while work is actively underway.

Identified: The PHP project released today a fix for two critical  vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5

As a precaution, we have taken Webhosting websites offline while we apply the patched PHP versions. Our team is actively working to patch and restore the service as soon as possible.

Resolved: This incident has been resolved.

Investigating: We added other impacted products and we are still investigating.

Investigating: We are continuing to investigate this issue.

Investigating: We are currently observing an increased rate of 5xx errors on the container registry in the fr-par region. Some image push and pull operations may fail or experience delays. Our teams are actively investigating, and we will provide an update as soon as more information is available.

Resolved: This incident has been resolved.

Investigating: We added other impacted products and we are still investigating.

Investigating: We are continuing to investigate this issue.

Investigating: We are currently observing an increased rate of 5xx errors on the container registry in the fr-par region. Some image push and pull operations may fail or experience delays. Our teams are actively investigating, and we will provide an update as soon as more information is available.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.

PHP

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).

Actions taken:

• Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
• Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).

Impact for you:

• PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
• If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.

Node.js

Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.

If you experience any issue, please contact our support team.

We apologize for any inconvenience and thank you for your patience.

Resolved: This incident has been resolved.

Investigating: We added other impacted products and we are still investigating.

Investigating: We are continuing to investigate this issue.

Investigating: We are currently observing an increased rate of 5xx errors on the container registry in the fr-par region. Some image push and pull operations may fail or experience delays. Our teams are actively investigating, and we will provide an update as soon as more information is available.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.

PHP

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).

Actions taken:

• Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
• Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).

Impact for you:

• PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
• If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.

Node.js

Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.

If you experience any issue, please contact our support team.

We apologize for any inconvenience and thank you for your patience.

Resolved: This incident has been resolved.

Investigating: We added other impacted products and we are still investigating.

Investigating: We are continuing to investigate this issue.

Investigating: We are currently observing an increased rate of 5xx errors on the container registry in the fr-par region. Some image push and pull operations may fail or experience delays. Our teams are actively investigating, and we will provide an update as soon as more information is available.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.

PHP

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).

Actions taken:

• Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
• Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).

Impact for you:

• PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
• If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.

Node.js

Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.

If you experience any issue, please contact our support team.

We apologize for any inconvenience and thank you for your patience.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.

PHP

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).

Actions taken:

• Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
• Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).

Impact for you:

• PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
• If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.

Node.js

Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.

If you experience any issue, please contact our support team.

We apologize for any inconvenience and thank you for your patience.

Resolved: This incident has been resolved.

Investigating: We are continuing to investigate this issue.

Investigating: Since 14:51 UTC, new RDB instance can't be provisioning in AMS

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.

PHP

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).

Actions taken:

• Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
• Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).

Impact for you:

• PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
• If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.

Node.js

Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.

If you experience any issue, please contact our support team.

We apologize for any inconvenience and thank you for your patience.

Resolved: This incident has been resolved.

Investigating: We are continuing to investigate this issue.

Investigating: Since 14:51 UTC, new RDB instance can't be provisioning in AMS

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.

PHP

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).

Actions taken:

• Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
• Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).

Impact for you:

• PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
• If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.

Node.js

Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.

If you experience any issue, please contact our support team.

We apologize for any inconvenience and thank you for your patience.

Resolved: This incident has been resolved.

Investigating: We are continuing to investigate this issue.

Investigating: Since 14:51 UTC, new RDB instance can't be provisioning in AMS

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.

PHP

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).

Actions taken:

• Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
• Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).

Impact for you:

• PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
• If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.

Node.js

Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.

If you experience any issue, please contact our support team.

We apologize for any inconvenience and thank you for your patience.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.

PHP

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).

Actions taken:

• Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
• Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).

Impact for you:

• PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
• If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.

Node.js

Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.

If you experience any issue, please contact our support team.

We apologize for any inconvenience and thank you for your patience.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.

PHP

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).

Actions taken:

• Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
• Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).

Impact for you:

• PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
• If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.

Node.js

Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.

If you experience any issue, please contact our support team.

We apologize for any inconvenience and thank you for your patience.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are currently experiencing degraded performance with it-mil APIs. Some requests may see elevated latency, intermittent errors, or timeouts. Our engineering team is actively investigating the issue and working to restore normal service as quickly as possible.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are currently experiencing degraded performance with it-mil APIs. Some requests may see elevated latency, intermittent errors, or timeouts. Our engineering team is actively investigating the issue and working to restore normal service as quickly as possible.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: We are currently experiencing degraded performance with it-mil APIs. Some requests may see elevated latency, intermittent errors, or timeouts. Our engineering team is actively investigating the issue and working to restore normal service as quickly as possible.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Resolved: The Dedibox Console and API are now back online and fully operational.

The security patches have been successfully applied to mitigate the PHP2Shell vulnerability.

Thank you for your patience and understanding.

Investigating: Investigation and mitigation of the PHP2Shell vulnerability are still ongoing. Your data and dedibox servers remain safe.

You can continue to manage Dedibox servers through the Scaleway Console.

We will restore the normal service status once maintenance is complete.

Investigating: Emergency Maintenance in Progress

As part of our investigation into the PHP2SHELL vulnerability (CVE), we are placing console.online.net and api.online.net into maintenance mode as a precautionary measure.

The entire console is temporarily unavailable. This maintenance affects only the control plane (Dedibox ordering system and management interface). Hosted servers and services are not affected.

Your data remains safe. This maintenance is a precautionary measure while we investigate the vulnerability.

We will provide an update as soon as the service is restored.

Identified: [Update] Security Maintenance – Web Hosting Services

Classic Shared Hosting / Mutu (Back online): Patched PHP versions (5.6, 7.0, 7.1, 7.2 and 7.3) have been fully deployed across all Classic shared hosting environments, and maintenance mode has been lifted. Websites are back online, except PHP 4 which remains in maintenance.

Current behavior per PHP version:

 -PHP 7.x: websites are served normally on their patched PHP version.
 -PHP 5.x: websites previously running PHP 5.2, 5.4 or 5.5 have been automatically migrated to PHP 5.6 (patched) and are served normally. We recommend that customers check that their websites are working correctly after this version change, following the recommendations in this guide: https://www.scaleway.com/en/docs/webhosting/reference-content/php-5-6-migration-guide/
 -PHP 4: websites remain in maintenance and are served a maintenance page. Customers can bring their websites back online by migrating to PHP 5.6 or later.

We apologize for the inconvenience, and thank you for your patience.

Identified: [Update] Security Maintenance – Web Hosting Services

Security patching for the php2shell vulnerability is progressing:

cPanel Environments (Resolved): PHP versions have been updated across all Scaleway and Online.net cPanel servers (as well as Scaleway Plesk). Maintenance mode has been lifted, and services are back online.

Classic Shared Hosting / Mutu (In Progress): Classic shared environments remain under maintenance while work is actively underway.

Identified: The PHP project released today a fix for two critical  vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5

As a precaution, we have taken Webhosting websites offline while we apply the patched PHP versions. Our team is actively working to patch and restore the service as soon as possible.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: RPN service unreachable for this rack since 2026/10/22 06:45 UTC

Resolved: The Dedibox Console and API are now back online and fully operational.

The security patches have been successfully applied to mitigate the PHP2Shell vulnerability.

Thank you for your patience and understanding.

Investigating: Investigation and mitigation of the PHP2Shell vulnerability are still ongoing. Your data and dedibox servers remain safe.

You can continue to manage Dedibox servers through the Scaleway Console.

We will restore the normal service status once maintenance is complete.

Investigating: Emergency Maintenance in Progress

As part of our investigation into the PHP2SHELL vulnerability (CVE), we are placing console.online.net and api.online.net into maintenance mode as a precautionary measure.

The entire console is temporarily unavailable. This maintenance affects only the control plane (Dedibox ordering system and management interface). Hosted servers and services are not affected.

Your data remains safe. This maintenance is a precautionary measure while we investigate the vulnerability.

We will provide an update as soon as the service is restored.

Resolved: This incident has been resolved.

Monitoring: A fix has been implemented and we are monitoring the results.

Investigating: RPN service unreachable for this rack since 2026/10/22 06:45 UTC

Resolved: This incident has been resolved.

Identified: En raison d’un volume exceptionnellement élevé de demandes, le traitement des tickets en cours peut prendre plus de temps que d’habitude. Nos équipes sont pleinement mobilisées afin de rétablir la situation et de traiter les demandes dans les meilleurs délais. Nous vous remercions pour votre patience et votre compréhension.

Due to a high volume of requests, the processing of ongoing tickets may take longer than usual. Our teams are fully mobilized to restore normal service and handle requests as quickly as possible. Thank you for your patience and understanding.

Resolved: This incident has been resolved.

Identified: Due to a high volume of requests, it may be difficult to reach our teams by phone. If needed, we invite you to contact us directly by submitting a ticket so that your request can be processed as quickly as possible. Thank you for your understanding.

En raison d’un nombre élevé de demandes, il peut être difficile de joindre nos équipes par téléphone. Au besoin, nous vous invitons à nous contacter directement par ticket afin que votre demande soit prise en charge dans les meilleurs délais. Merci de votre compréhension.

Identified: En raison d’un volume exceptionnellement élevé de demandes, le traitement des tickets en cours peut prendre plus de temps que d’habitude. Nos équipes sont pleinement mobilisées afin de rétablir la situation et de traiter les demandes dans les meilleurs délais. Nous vous remercions pour votre patience et votre compréhension.

Due to a high volume of requests, the processing of ongoing tickets may take longer than usual. Our teams are fully mobilized to restore normal service and handle requests as quickly as possible. Thank you for your patience and understanding.

Identified: En raison d’un volume exceptionnellement élevé de demandes, le traitement des tickets en cours peut prendre plus de temps que d’habitude. Nos équipes sont pleinement mobilisées afin de rétablir la situation et de traiter les demandes dans les meilleurs délais. Nous vous remercions pour votre patience et votre compréhension.

Due to a high volume of requests, the processing of ongoing tickets may take longer than usual. Our teams are fully mobilized to restore normal service and handle requests as quickly as possible. Thank you for your patience and understanding.

Investigating: En raison d’un volume exceptionnellement élevé de demandes, le traitement des tickets en cours peut prendre plus de temps que d’habitude. Nos équipes sont pleinement mobilisées afin de rétablir la situation et de traiter les demandes dans les meilleurs délais. Nous vous remercions pour votre patience et votre compréhension.

Due to a high volume of requests, the processing of ongoing tickets may take longer than usual. Our teams are fully mobilized to restore normal service and handle requests as quickly as possible. Thank you for your patience and understanding.

Identified: Due to a high volume of requests, it may be difficult to reach our teams by phone. If needed, we invite you to contact us directly by submitting a ticket so that your request can be processed as quickly as possible. Thank you for your understanding.

En raison d’un nombre élevé de demandes, il peut être difficile de joindre nos équipes par téléphone. Au besoin, nous vous invitons à nous contacter directement par ticket afin que votre demande soit prise en charge dans les meilleurs délais. Merci de votre compréhension.

Investigating: Due to a high volume of requests, it may be difficult to reach our teams by phone. If needed, we invite you to contact us directly by submitting a ticket so that your request can be processed as quickly as possible. Thank you for your understanding.

En raison d’un nombre élevé de demandes, il peut être difficile de joindre nos équipes par téléphone. Au besoin, nous vous invitons à nous contacter directement par ticket afin que votre demande soit prise en charge dans les meilleurs délais. Merci de votre compréhension.

Resolved: This incident has been resolved.

Identified: Update at 18:40 CEST The BookMyName website, its webmail, and the RDAP services are back up. The redirection service is still down: it requires further investigation before it can be patched and restored.

Investigating: Started: 21 Oct 2026, 15:50 CEST Status: Emergency maintenance in progress Impact: All BMN services are unavailable.

The PHP project released today a fix for two critical  vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5

As a precaution, we have taken BMN services offline while we apply the patched PHP versions. Our team is actively working to patch and restore the service as soon as possible.

Resolved: This incident has been resolved.

Identified: On 2026-10-21, a critical PHP RCE (CVE-2026-109618/109619, CVSS 9.2) forced an emergency migration of the BookMyName services. The migration introduced PHP compatibility regressions in legacy code, impacting customers since 2026-10-21.