No impact incident

Linode: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities

Current status of Linode: Operational — live Linode status

Timeline

1. Oct 21, 2026, 14:44 UTC
   investigating
   Akamai is aware of the recently published (CVE-2026-109618 and CVE-2026-109619) vulnerabilities and our teams are actively investigating its potential impact across our platform and infrastructure. As a part of ongoing mitigation efforts, some Quick Deploy Apps, speed test pages, and parts of the website may be unavailable. If you are running a vulnerable version of PHP on a Linode instance, we recommend following guidance from the upstream vendor (PHP) and applying upstream patches as they become available. We will provide updates as additional information becomes available.
2. Oct 21, 2026, 17:41 UTC
   identified
   Updated Guidance after assessment: Akamai is aware of the recently published (CVE-2026-109618 and CVE-2026-109619) vulnerabilities and our teams are actively investigating its potential impact across our platform and infrastructure. As a part of ongoing mitigation efforts, our Cloud Infrastructure Speed Tests will be unavailable. If you are running a vulnerable version of PHP on a Linode instance, we recommend following guidance from the upstream vendor (PHP) and applying upstream patches as they become available. We will provide updates as additional information becomes available.
3. Oct 22, 2026, 18:19 UTC
   identified
   Akamai is aware of the recently published (CVE-2026-109618 and CVE-2026-109619) vulnerabilities and our teams are actively investigating its potential impact across our platform and infrastructure. As a part of ongoing mitigation efforts, our Cloud Infrastructure Speed Tests will be unavailable. If you are running a vulnerable version of PHP on a Linode instance, we recommend following guidance from the upstream vendor (PHP) and applying upstream patches as they become available. We will provide updates as additional information becomes available.
4. Oct 23, 2026, 20:37 UTC
   resolved
   Akamai has completed its assessment of the recently published PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) across our platform and infrastructure, and mitigation efforts are complete. Cloud Infrastructure Speed Tests will remain offline in the near term. We plan to bring them back online in the near future. If you are running a vulnerable version of PHP on a Linode instance, we recommend following guidance from the upstream vendor (PHP) and applying upstream patches as they become available. We appreciate your patience while our teams completed this work.

Updates as published by Linode (original).