Two critical vulnerabilities in one week: how we kept our cloud secure

Last week, the IT industry faced two critical vulnerabilities within days of each other. On Monday, October 19, PwnEscape (CVE-2026-99999) was disclosed: a long-standing flaw in the IPv4 networking code of the Linux kernel that allowed a virtual machine to break out of isolation and read host memory. On Wednesday, October 21, the PHP project released emergency patches for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), two critical remote code execution flaws in the PHP runtime, with active exploitation already observed in the wild.

As soon as details on PwnEscape were available, our security team assessed the impact on our infrastructure. All KVM-based host systems were updated, following our established change management processes enabled by targeted monitoring.

When the PHP2Shell emergency patches landed on Wednesday, we were ready. Our insight published that same day confirmed that we would apply the patches as soon as they became available. Within hours of the release, all affected PHP versions in our cloud were updated to the patched releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Transparent communication with customers was a priority, so we published a follow-up insight confirming that the issue was fully mitigated across all systems. Today, both vulnerabilities are closed in our infrastructure, and our monitoring detected no exploitation on our systems.

This week showed that our continuous monitoring, incident processes, and patching speed work when it matters. We will keep acting with the same speed and transparency whenever the security of our systems and the data of our customers is at risk.