Monitoring
Access to cloud service is restored. Some customer may experience "421 Misdirected Request" while cache gets updated.
Identified
Patched Docker images, AWS AMI and OVA are now published. Docker users can pull the latest image and redeploy. For existing AMI and OVA instances, update PHP through your system’s package manager: a new image only applies to new deployments.
DigitalOcean images are awaiting marketplace review, and the Helm chart update is in progress.
Identified
Linux distributions are publishing patched PHP packages. Self-hosted administrators using Passbolt’s distribution packages can update PHP on their servers. The fixed versions are listed on php.net.
Identified
The PHP security team has released the patch for CVE-2026-109618 and CVE-2026-109619. Our team is now updating Passbolt Cloud and the self-hosted images (Docker, OVA, DigitalOcean). Passbolt Cloud will be restored once the update is deployed and verified.
Monitoring
In light of the recent publication of a critical PHP vulnerability https://cert.europa.eu/publications/security-advisories/2026-018 and even though the service has applied all mitigations proposed by the community we decided to take the service down till the time of the publication of the patch 14.00 UTC.
We take this decision to protect our customers data.
