October was a busy month for the blog. Read this monthly OVHcloud Blog recap to scan the highlights: from the FY2026 results letter to SecNumCloud, to two PHP security stories, to hands-on guides for OpenTofu and AI agents. Skim the sections below, or jump straight into the posts that matter to you.
Story of the month: our FY2026 results
One year after taking back the helm, where does OVHcloud stand? Octave Klaba, founder and CEO of OVHcloud, answers in his letter to shareholders, employees, and customers, published on 18 October. He looks back on a year of the Step Ahead plan and lists the foundations he considers strategic: owned datacentres, a global network, in-house server production, and more than 80 Public Cloud products. He also covers AI, from the OVHai Workspace platform to services designed for AI agents. He says OVH Group is free cash flow positive again and aims to fund its next investment cycle without raising equity. Read the full letter for his plans for FY2027.
Sovereignty and open source
SNC Cloud Platform achieves SecNumCloud qualification
Can you run sensitive workloads with public-cloud agility? This post explains how SNC Cloud Platform, OVHcloud's public-cloud-style offer, earned SecNumCloud qualification from ANSSI, France's cybersecurity agency. It's the third OVHcloud offer to be qualified, after Bare Metal Pod and VMware on OVHcloud, and the qualification rests on an audit of close to 1,200 requirements. You'll also find the availability calendar by region, with Italy, Germany, and Poland next in line. Find out what the qualification covers before you plan a migration.
OVHcloud becomes a CNCF Platinum Member
Who helps decide how cloud native technology evolves? OVHcloud has upgraded to Platinum membership of the Cloud Native Computing Foundation (CNCF) and is the only cloud provider headquartered in Europe at the foundation's highest tier. It's one of three European-headquartered companies among the 19 Platinum members, and it now has a seat on the CNCF Governing Board, held by Yaniv Fdida, Chief Product and Technology Officer. Learn what the membership means for Kubernetes and open source.
Security
Critical PHP vulnerabilities: how to protect your servers
On 21 October, the PHP project fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 on the CVSS scale. Left unpatched, they can let an attacker take over a server remotely, without credentials. If PHP runs on your Bare Metal server or VPS, the post shows how to check your version in two minutes, update, and restart your PHP services, with temporary mitigations if you can't update straight away. Shared hosting customers get an updated PHP component automatically. Follow the step-by-step guide to protect your servers.
php2shell: how we protected more than 6 million websites
The same vulnerabilities are here seen from the shared hosting side. This post tells how OVHcloud's teams protected more than 6 million websites across 15 PHP versions, eight of which no longer receive official fixes, using a web application firewall rule, updated packages, and backported fixes. If your site is on OVHcloud shared hosting, you don't need to do anything. Developers should note one change: a script that exceeds its memory limit now stops immediately. Explore how the response unfolded over four days.
Hosting and domains
Managed Hosting for WordPress
OVHcloud hosts more than 6 million websites, over 80% of them on WordPress, and built Managed Hosting for WordPress to absorb the daily maintenance. The first post explains why hosting a site is no longer about disk space alone. The second looks inside Smart Automatic Updates, which tests every update on a clone, comparing page status codes and screenshots, before anything goes live. Start with the reasoning behind managed WordPress hosting, then see how Smart Automatic Updates work.
The .si domain super intelligence rush
Two letters made domain news. After US federal agencies were asked to use "SI" as shorthand for artificial intelligence, registrations of Slovenia's .si extension surged: the post cites Netcraft figures showing about 13 times as many .si domains registered in September as in August. It explains how .si differs from .ai, the risks of speculation and typosquatting, and four checks to protect your brand name. Find out how to secure your name in .si.
Engineering
OpenTofu State Encryption with OVHcloud KMS
Want to protect your infrastructure state at rest? OpenTofu can now encrypt state and plan files with keys managed in OVHcloud KMS, thanks to a key provider that OVHcloud maintains. The tutorial walks through the prerequisites (OpenTofu v1.13 or later), the setup, and a first encrypted state. It also states plainly what encryption doesn't do: it's not a substitute for backups or state management. Work through the OpenTofu tutorial step by step.
Hermes: an AI agent on a VPS
Meet Hermes, an open source AI agent that lives on a small VPS in a European datacentre and keeps working after you've closed your laptop. The author explains why an agent on a laptop is fragile and how to start your own on a VPS in about ten minutes, with a GitHub repository to help. Hermes can also use OVHcloud AI Endpoints. Discover the Hermes story (in French).
Education and sustainability
Choosing a sustainable cloud provider
Green claims are easy to make and hard to compare. This guide gives you three verifiable criteria for judging a provider: audited metrics, hardware lifecycle, and investment in research. For each, it lists the questions to ask and an OVHcloud example, including the FrugalCloud research challenge with Inria. Run through the three criteria to assess where OVHcloud and other providers stand.
OVHcloud Education partnerships
Back to school! OVHcloud Education announced partnerships with four schools in October: Cybersup, Coda School, HETIC, and SKOLAE Tours. They bring masterclasses, hands-on projects, and cloud certifications to hundreds of students, from 500 across three campuses at Coda School to 200 at HETIC. Read about Cybersup, Coda School, HETIC, and SKOLAE Tours (all in French).
News from the Developer Advocates
Want to hear OVHcloud's tech talks in person? Stéphane Philippart and Aurélie Vache, Developer Advocates at OVHcloud, took the stage at WAX in Marseille, Devoxx Belgium in Antwerp, KCD UK in Edinburgh, Cloud Native Days Norway in Bergen, BDX I/O in Bordeaux, and Codemotion in Milan. Their roundup also looks ahead to KubeCon North America and the OVHcloud AI Summit on 19 November. See the team's monthly roundup for the full agenda, and listen to episode 31 of the podcast with Tech Lead Léonore Des Plas (in French).
Until the next OVHcloud Blog recap
That's October covered. In the meantime, catch each new article as it's published through our RSS feed, and look out for the next OVHcloud Blog recap.