The Brotli RCE (CVE-2026-111497) has been mitigated fleet-wide, and on all customer servers that are managed by our team.

We will continue to work on the remaining CVEs, applying mitigations where available and awaiting fixed versions from upstream.

Thank you for your patience and cooperation.

We are continuing to deploy alt-php updates fleet-wide. ea-php is already patched.

We will provide an update once the rollout is complete.

Work is starting on applying the same updates to customer servers that are managed by us.