support@mutual.agency

Most client websites are paused as a precaution.

Updated

Systems

Sites hosted on Servd

In maintenance mode. Visitors see a maintenance page, and no requests reach PHP.

Maintenance

Sites hosted on Craft Cloud

Online. Craft Cloud is deploying a mitigation that blocks parts of PHP, so some features, including the CMS, may not work fully until the patch.

Degraded

Other hosted sites

A firewall rule is blocking all inbound traffic until a fix is in place.

Blocked

Support

Operational

Active incidents

Critical PHP security release

  1. Next

    We bring sites back online as each is upgraded and tested, and update this page as they go live.

  2. 21 Oct, 15:00

    PHP security release due . We start upgrading every server we host as soon as it lands.

  3. Now

    Assessing mitigations. Craft Cloud is rolling out its own mitigation. For everything else, we’re reviewing what we can safely put in place ahead of the patch, and preparing every server so the upgrade goes out quickly.

  4. 21 Oct, 08:00

    Public access to client websites closed. Servd sites went into maintenance mode, and a firewall rule now blocks sites on our other hosting. Craft Cloud sites stayed online. A deliberate precaution, not a response to an attack on any site we look after.

  5. 20 Oct

    The PHP security team gives advance notice of a critical release fixing two vulnerabilities, both rated 9.2 out of 10 for severity. Details stay private until the release.

    Flaws this serious tend to be exploited within hours of going public, so we’re keeping sites closed or shielded until they’re patched. Your content and data are untouched, and there’s nothing you need to do.