{
  "is": "issue",
  "title": "Virtual server management unavailable ahead of PHP security release",
  "body": "\u003cp\u003e\u003cstrong\u003eResolved \n  \u003cspan class=\"faded\"\u003e(18:40 UTC — Oct 21)\u003c/span\u003e\n\n\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eSolusVM have released a patched version that we have now deployed to our management node.\u003c/p\u003e\n\u003cp\u003eAs a result, we are confident to restore the full functionality of our virtual servers platform.\u003c/p\u003e\n\u003cp\u003eIf you find any issues following the restoration, please \u003ca href=\"https://www.sr2.uk/contact\"\u003eget in touch\u003c/a\u003e.\u003c/p\u003e\n\u003chr\u003e\n\u003cp\u003e\u003cstrong\u003eUpdate \n  \u003cspan class=\"faded\"\u003e(14:40 UTC — Oct 21)\u003c/span\u003e\n\n\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eThe PHP team have released a patch to correct this vulnerability and wer are working to implement it.\u003c/p\u003e\n\u003cp\u003eDue to the embedded nature of some of PHP in these services, they may require us to wait for an upstream patch before we can update our systems.\u003c/p\u003e\n\u003chr\u003e\n\u003cp\u003eAs a precautionary measure, we have temporarily taken our SolusVM management node offline. SolusVM uses PHP and could be affected by the \u003ca href=\"https://www.php.net/archive/2026.php#2026-10-20-1\"\u003eupcoming critical PHP security release\u003c/a\u003e, which is scheduled for \u003cstrong\u003eWednesday 21 October 2026 at 14:00 UTC (15:00 BST)\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eExisting virtual servers continue to run normally.\u003c/strong\u003e However, no configuration changes can be made until the management node is restored.\u003c/p\u003e\n\u003cp\u003eIn exceptional circumstances, we can shut down virtual machines if this is required for incident response. Please call \u003cstrong\u003e+44 333 1127 999\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eThere is no evidence of compromise.\u003c/strong\u003e We will restore the management node once we have confirmed that it is running a patched version of PHP.\u003c/p\u003e\n",
  "createdAt": "2026-10-21 10:01:00 +0100 +0100",
  "lastMod": "2026-10-21 19:41:32 +0100 +0100",
  "permalink": "https://status.sr2.uk/issues/2026-10-21-solus-php-vulnerability/",
  "severity": "disrupted",
  "resolved": true,
  "informational": false,
  "resolvedAt": "2026-10-21T19:40:00+01:00",
  "affected": ["Virtual Servers"],
  "filename": "2026-10-21-solus-php-vulnerability.md"
}