Incident History

Back to status page

  1. Oct 21, 2026

    1. Critical PHP CVE Mitigation Patch Update

      All Craft 5 websites hosted on Servd now have the PHP patch in place, and we're currently in-progress with Craft 4 websites.

    2. Critical PHP CVE Mitigation Patch Available

      Servd has now released patches for PHP 8.2-8.5. We'll proceed with implementing these patches, which will automatically remove the multipart upload block.

      Sites running PHP 8.1 or lower will need to be updated to PHP 8.2 or higher as soon as possible. The multipart upload block will remain in place for the foreseeable future but will be automatically lifted once updated.

      These is still no action needed on your end.

    3. Critical PHP CVE Mitigation In-Progress

      The official PHP patch has been published, and Servd will have patched PHP versions available shortly.

    4. Critical PHP CVE Mitigation Notice

      Image/file uploads are currently failing on Craft CMS sites hosted on Servd because of a security issue affecting websites across the web today:

      What happened

      A critical security vulnerability was discovered in PHP, the programming language that powers your website (and a large share of sites on the internet). The details are being made public today, and because the flaw is very easy to exploit, hosting providers are moving quickly to protect the sites they run.

      What our hosting provider is doing

      Servd took immediate action this morning by blocking the type of request the vulnerability relies on across all of the sites they host. This is a precautionary step that keeps your site secure while a permanent fix is put in place.

      The trade-off is that this same type of request is used for uploading files. Until the fix is applied, you'll see an error if you try to:

      • Upload images or files in the CMS
      • Submit any forms on your site that include a file attachment

      Everything else on your site, including browsing, editing existing content, and publishing, should continue to work normally.

      What happens next

      The PHP team is releasing an official patch today. Once Servd has prepared and tested it, they'll make it available, and we'll deploy the update to your site. That update will automatically restore uploads. Servd expects this to happen later today, though the timeline could shift if the PHP release is delayed or if the patch needs further adjustments.

      What you need to do

      Nothing. We're monitoring the situation and will handle the update for you. We appreciate your patience as our hosting provider protects against this critical PHP security vulnerability.