Update - We are continuing to work on the patched version of Deskpro and have been able to make significant progress to being able to release.

We are still seeing significant delays in the third-party software sources that is hampering us but continuing to monitor a progress where we can.

Deskpro Cloud will stay offline until the patched version has been deployed and checked. We cannot yet give a restore time.

Oct 21, 2026 - 19:33 BST
Update - We are continuing to work on the patched version of Deskpro.

We are seeing significant delays in the third-party software sources that we and many other software providers around the world depend on for PHP’s fixes and that allow us to ship changes safely.

Deskpro Cloud will stay offline until the patched version has been deployed and checked. We cannot yet give a restore time.

Oct 21, 2026 - 18:34 BST
Update - We are still working on the patched version of Deskpro. Progress is slower than we expected due to delays in the third-party software sources that we and many other software providers around the world depend on for PHP’s fixes.

Deskpro Cloud will stay offline until the patched version has been deployed and checked. We cannot yet give a restore time.

Oct 21, 2026 - 17:39 BST
Update - We are continuing to prepare and test a patched version of Deskpro using the fixes released by PHP.
Deskpro Cloud will stay offline until the patched version has been deployed and checked, as of yet, we cannot give a restore time.

Email sent to Cloud helpdesks during the outage is still being received and will be processed once service is restored. support.deskpro.com remains offline; please email [email protected].

Self-hosted: We will email customers when a patched release is available. Until then, please follow the guidance in our earlier email today.

Oct 21, 2026 - 16:50 BST
Update - PHP has published fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (https://www.php.net/archive/2026.php). Following UK NCSC guidance (https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php), Deskpro Cloud remains offline as a precaution.

We are building and testing patched versions now. Cloud sites will return once the patched version is deployed and checked. We cannot yet give a restore time.

Email sent to Cloud helpdesks during the outage is still being received and will be processed once service is restored.
Support: support.deskpro.com is offline. Please email [email protected] where we are monitoring incoming correspondance.
Self-hosted: We will email customers when a patched release is available. Until then, please follow the guidance in our earlier email today.

Oct 21, 2026 - 16:04 BST
Update - Correction:
PHP has released fixes for the two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Their security advisory is here: https://www.php.net/archive/2026.php#2026-10-21-5

We are waiting for the official PHP docker images in order for us to build and test updated versions of Deskpro with the patched PHP. Deskpro Cloud will stay offline until the fix is in place, and we will bring services back as soon as it is safe to do so. Our next update will be by 17:00 BST.

Oct 21, 2026 - 14:47 BST
Update - Deskpro Cloud is being taken offline temporarily as a precaution, in line with guidance from the UK National Cyber Security Centre  (NCSC).
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Oct 21, 2026 - 13:28 BST
Update - Additional web application firewall rules are now active on Deskpro Cloud. Our network provider released them in response to these reports, and we are confirming they work as expected.

PHP's security release is still scheduled for 14:00 UTC (15:00 BST) today. Once it is out, we will build, test and roll out an updated Deskpro Cloud release. This will take several hours, and we will post here when the rollout starts.

If you host Deskpro yourself (DPC), we will share guidance once PHP's fix is available.

Oct 21, 2026 - 10:58 BST
Monitoring - We are aware of two security vulnerabilities in PHP, the programming language Deskpro is built on: CVE-2026-109618 and CVE-2026-109619. PHP has scheduled a security release for 14:00 UTC (15:00 BST) today, 21 October, which is expected to fix them.

- We are preparing to apply PHP's fix to Deskpro Cloud as soon as it is released.
- If you host Deskpro yourself, we will share guidance on updating once PHP's fix is available.

If you have any questions, please contact our support team.

Oct 21, 2026 - 09:51 BST
Admin Interface Under Maintenance
Agent Interface Under Maintenance
User Interface / Portal Under Maintenance
Reports Interface Under Maintenance
Billing Interface Under Maintenance
API Under Maintenance
Incoming Email Operational
Outgoing Email Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance

Oct 21, 2026

Unresolved incident: Security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619).

Oct 20, 2026

No incidents reported.

Oct 19, 2026

No incidents reported.

Oct 18, 2026

No incidents reported.

Oct 17, 2026

No incidents reported.

Oct 16, 2026

No incidents reported.

Oct 15, 2026

No incidents reported.

Oct 14, 2026

No incidents reported.

Oct 13, 2026

No incidents reported.

Oct 12, 2026

No incidents reported.

Oct 11, 2026

No incidents reported.

Oct 10, 2026

No incidents reported.

Oct 9, 2026

No incidents reported.

Oct 8, 2026

No incidents reported.

Oct 7, 2026

No incidents reported.