Scaleway outage history and live incidents

Status: identified On 2026-10-21, a critical PHP RCE (CVE-2026-109618/109619, CVSS 9.2) forced an emergency migration of the BookMyName services. The migration introduced PHP compatibility regressions in legacy code, impacting customers since 2026-10-21.

Status: investigating Due to an abnormal charge, some Scaleway product logs might have been ingested with delay and some might have been dropped We observe some drop on Serverless logs This issue is now resolved

Status: investigating We are informing you of critical security updates applied to the PHP and Node.js runtimes used by Serverless Functions. --- PHP Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution without credentials on PHP versions prior to the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Actions taken: - Functions previously running PHP 8.2 or 8.3 have been force-redeployed on PHP 8.4, which is patched. - Functions running PHP 8.4 or 8.5 have been force-redeployed on the patched versions (8.4.27 / 8.5.12). Impact for you: - PHP 8.2 and 8.3 are now end-of-life on our platform: they can no longer be used to create or redeploy functions. Please update your runtime to PHP 8.4 or 8.5. - If you manage your functions through Infrastructure as Code (Terraform or Serverless Framework with serverless.yaml), please update your configuration to the new runtime, otherwise your infrastructure will drift. --- Node.js Patched versions of Node.js 22, 24 and 26 are now available (22.23.4, 24.22.1, 26.12.1). To apply the security patches, please redeploy your functions. If you experience any issue, please contact our support team. We apologize for any inconvenience and thank you for your patience.

Status: investigating RPN service unreachable for this rack since 2026/10/22 06:45 UTC

Status: investigating Since 7 pm, dedicated deployment deletion has been failing. Re-creation after deletion will remain impossible until the incident is resolved.

Status: identified The PHP project released today a fix for two critical  vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5 As a precaution, we have taken Webhosting websites offline while we apply the patched PHP versions. Our team is actively working to patch and restore the service as soon as possible.

Status: investigating Emergency Maintenance in Progress As part of our investigation into the PHP2SHELL vulnerability (CVE), we are placing console.online.net and api.online.net into maintenance mode as a precautionary measure. The entire console is temporarily unavailable. This maintenance affects only the control plane (Dedibox ordering system and management interface). Hosted servers and services are not affected. Your data remains safe. This maintenance is a precautionary measure while we investigate the vulnerability. We will provide an update as soon as the service is restored.

Status: investigating Started: 21 Oct 2026, 15:50 CEST Status: Emergency maintenance in progress Impact: All BMN services are unavailable. The PHP project released today a fix for two critical  vulnerabilities allowing unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 — no complete mitigation exists): https://www.php.net/archive/2026.php#2026-10-21-5 As a precaution, we have taken BMN services offline while we apply the patched PHP versions. Our team is actively working to patch and restore the service as soon as possible.

Status: resolved An upgrade operation of the Block storage api on fr-par-2 generated a blocking transaction which impacted the control plane of this AZ The issue occurred from 12:23 to 12:28 UTC and generated a high rate of 500 errors. The problem was quickly fixed by the engineers of the product team.

Status: monitoring New deployment creation is temporarily unavailable due to infrastructure capacity constraints. Existing deployments are unaffected. We've identified the situation.

Status: resolved * 2026-10-20 17:45 CEST : Partial unavailability of custom logs datasource * 2026-10-20 18:00 CEST : mitigation deployed, stabilizing availability progressively * 2026-10-21 05:00 CEST : automated event happened, which triggered partial unavailability again for part of our customers. * 2026-10-21 09:45 CEST : stabilization of our infrastructure, back to nominal situation

Status: resolved Users signing in with SAML who had not yet configured MFA were unable to log in. The issue was caused by a recent frontend release. A fix has been implemented, and an updated version of the account app is being deployed.

Status: investigating Started Tuesday 20th October @ 5:04pm The glm-5.3 model is consistently returning timeout errors on all requests. We are working at fixing the issue.

Status: identified Following an infrastructure deployment, connectivity was disrupted across several racks, potentially impacting Object Storage customers in the fr-par region through increased latency and request errors. The issue has been identified, and our engineering teams are currently deploying a fix to restore normal service operations.

Status: investigating Started Tuesday 20th October 2:50pm The model is not available. We're working to fix it asap.

Status: investigating After a faulty deployment, listing data exporters in the Cockpit Console results in error.

Status: investigating We are currently experiencing degraded performance with it-mil APIs. Some requests may see elevated latency, intermittent errors, or timeouts. Our engineering team is actively investigating the issue and working to restore normal service as quickly as possible.

Status: identified 19th October from 2:30pm to 7pm Some requests to the deepseek-v4.1-flash model have experienced elevated timeouts. We have implemented a mitigation, and error rates are improving. We're monitoring the situation.

Status: investigating Since Saturday October 18, 2026 at 07:55 UTC (09:55 Paris time), Serverless SQL Databases as occured slow cold start for the DB and DB in status error.

Status: investigating PUB service down on devices located in PARDC3 / Room 4-4 / Rack C18  since 2026/10/18 12:30 UTC, Checks in progress

Status: identified An issue on a network device generated instability between 2026/10/17 10:42 UTC and 2026/10/17 10:57 UTC for devices located in rack 6.12.32 room Hall6 in AMS1

Status: investigating We are currently experiencing an issue with the public switch located in Rack S46-E16 at Opcore-DC3. The switch is currently unreachable, and the root cause of the issue is still under investigation. As a result, all customer servers connected to this switch are currently unreachable. Our team is investigating the situation and will provide further updates as soon as more information becomes available.

Status: investigating Several reports of inconsistencies in the zones between our DNS servers s0.dom.scw.cloud and s1.dom.scw.cloud

Status: investigating We are currently observing an increased rate of 5xx errors on the container registry in the fr-par region. Some image push and pull operations may fail or experience delays. Our teams are actively investigating, and we will provide an update as soon as more information is available.