PHP Vulnerability Responses by Company

Upsun

Global cloud / infrastructure
Aliases / services
Platform.sh / プラットフォームシェル / アップサン / Upsun
Official website
https://upsun.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Upsun Cloud — PHP 8.2–8.5 runtime

Response status
Patched rollout; failed redeploys need action
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

The October 23 technical update confirms patched runtimes and redeploys, including Dedicated. Environments with failed builds or deployment hooks still run the old PHP.

Scope: Fleet rollout does not imply that failed environments were patched. Composable images are a separate scope.

What users should do

Verify the runtime and deployment result; fix failures and redeploy. Move from Upsun-deprecated 8.2/8.3 to 8.4 or later.

Official service URL

Source URLs

  1. https://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-checkhttps://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-checkResponse evidence
  2. https://upsun.com/blog/php2shell-upsun-response/https://upsun.com/blog/php2shell-upsun-response/Service and operation documentation
  3. PHP's critical security release: what Upsun is doinghttps://upsun.com/blog/php-critical-security-release-oct2026/Response evidence

Upsun Cloud — PHP 8.1 and earlier runtimes

Response status
7.2–8.1 patched; <=7.1 must upgrade
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Patched images cover 7.2/7.3/7.4/8.0/8.1. PHP <=7.1 has no patch; WAF protection is mitigation only. Failed redeploys remain unpatched.

Scope: Do not mark all old branches patched. This backport does not restore normal support.

What users should do

Compare image revisions with the official table. Repair failed redeploys and urgently migrate <=7.1 to 8.4 or later.

Official service URL

Source URLs

  1. https://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-checkhttps://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-checkResponse evidence
  2. https://upsun.com/blog/php2shell-upsun-response/https://upsun.com/blog/php2shell-upsun-response/Service and operation documentation
  3. PHP's critical security release: what Upsun is doinghttps://upsun.com/blog/php-critical-security-release-oct2026/Response evidence

PHP in Upsun Cloud composable images

Response status
26.05 patched; older images need migration
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Patched rollout completed October23 for26.05; earlier image versions do not receive the patch.

Scope: Update conditions differ from php runtime images.

What users should do

Test and deploy composable:26.05, then verify PHP.

Source URLs

  1. https://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-checkhttps://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-checkResponse evidence
Related official sources
  1. PHP's critical security release: what Upsun is doingOfficial notice
  2. Upsun incident statusOfficial information directory

Comments