No impact incident

Instructure: PHP awareness

Oct 21, 2026, 20:43 UTC

started

open

no update since October 21, 2026

—

duration

Current status of Instructure: Operational — live Instructure status

Timeline

Oct 21, 2026, 20:43 UTC
monitoring
Instructure is aware of CVE-2026-109618 and CVE-2026-109619 (referred to as "PHP2Shell"), affecting PHP. The Canvas application does not use PHP and is not affected. We have completed an initial assessment of our other products. Where affected PHP versions are in use, we are prioritizing remediation and have implemented compensating controls and additional monitoring while that work is completed. We will update as remediation progresses.

Updates as published by Instructure (original).

This was part of a wider event: 13 services reported incidents within the hour.

JWX 21:39 UTC · Degraded Instant Live playback - 21 October 2026
Qualys 21:39 UTC · US Platform 01: Users accessing VMDR module getting redirected to login page [IM-12932]
Pitney Bowes 21:35 UTC · UPS Service Disruption Observed for RateShipment.
PlayFootball 21:33 UTC · PlayFootball Release Notes (22nd of October 2026)
mux 21:30 UTC · Degraded VOD playback
ClearSale 21:15 UTC · Instabilidade no tempo de resposta nos Insights
ClearSale 21:12 UTC · Instabilidade no tempo de resposta
Optum 21:09 UTC · System Incident - Medical Network - Batch - Production
Osano 20:52 UTC · Partial Outage - Degraded Service
LogicMonitor 20:45 UTC · LogicMonitor is currently investigating potential impacts to our Account Access Component(s).
Parchment 20:45 UTC · Instructure is aware of CVE-2026-109618 and CVE-2026-109619 (referred to as "PHP2Shell"), affecting PHP.
Kandji 20:37 UTC · Slow Load Times in the Iru Web App
impact.com 20:23 UTC · General Reporting Delay - Actions only (Tracking Unaffected)
UserTesting 20:12 UTC · Tree Test and Card Sort
Kaseya 20:08 UTC · RocketCyber - EU Region - Pages loading slow or not at all