Resolved. Every server's Coolify dashboard is back online on a build with the patched PHP 8.4.27, as of 16:18 UTC. Deployments, scheduled tasks and Coolify scheduled backups run again from their next scheduled time. A check of every server before restoring found no sign of unauthorized access; customers are being emailed the details.

At 13:35 UTC on 21 October we stopped the Coolify dashboard on every MapleDeploy server because of two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), which Coolify runs on. Your deployed apps, websites and databases are running as normal. While the dashboard is off you cannot sign in to Coolify, and new deployments, scheduled tasks and Coolify scheduled backups will not run. PHP released the fix at 14:00 UTC. We are building the patched version now and will turn dashboards back on once it has been tested, then email every customer.