Scalingo

Global hosting

Aliases / services: Scalingo / scalingo.com
Official website: https://scalingo.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

PHP applications / router

Response status: Fixed releases available; redeployment required
Response information checked: 2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

FixedPHP8.2.35,8.3.36,8.4.27 and8.5.12 became available October21 at16:40UTC+2. Existing apps need rebuilding/redeployment with compatible constraints.

Scope: Pinned/custombuildpacks do not update automatically. Redeployment alone does not lift router restrictions; mitigation does not replace both fixes.

What users should do

Confirm successful deployment and the running version;restart alone is insufficient. After verifying the patch, useCLI1.51.0+ to re-enable multipart uploads.

Official service URL

https://scalingo.com/

Source URLs

Scalingo: PHP vulnerability responsehttps://doc.scalingo.com/security/bulletins/ssb-2026-005Response evidence

Related official sources

Scalingo: PHP vulnerability responseOfficial notice