[Serverless Functions][fr-par/nl-ams/pl-waw] Security updates applied to PHP and Node.js runtimes
View the provider incident record →Current answer
Scaleway experienced a minor incident: [Serverless Functions][fr-par/nl-ams/pl-waw] Security updates applied to PHP and Node.js runtimes. ServiceAlert observed recovery on Oct 22, 2026.
Looking for an update now? Check the current status, or follow Scaleway for future changes.
Incident Lifecycle
Affected Components
fr-par-1
fr-par-2
fr-par-3
nl-ams-1
nl-ams-2
nl-ams-3
pl-waw-1
pl-waw-2
pl-waw-3
Serverless Functions
Incident Timeline
Monitoring
A fix has been implemented and we are monitoring the results.
Oct 22, 2026 at 3:28 PM UTC
Investigating
We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions.
---
PHP
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).
Actions taken:
- Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
- Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).
Impact for you:
- PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
- If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.
---
Node.js
Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.
If you experience any issue, please contact our support team.
We apologize for any inconvenience and thank you for your patience.
---
PHP
Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12).
Actions taken:
- Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched.
- Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12).
Impact for you:
- PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5.
- If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift.
---
Node.js
Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions.
If you experience any issue, please contact our support team.
We apologize for any inconvenience and thank you for your patience.
Oct 22, 2026 at 3:18 PM UTC
Was your business affected by this Scaleway outage?
Follow Scaleway and route available status alerts to email or a team channel.