Ynotone - Status Page

On Oct 21, 2026, a critical vulnerability in Node.js (CVE-2026-111497, "Node2Shell") was publicly disclosed. It allows remote code execution when an application decodes untrusted Brotli-compressed data, and it affected the Node.js version used by some of our background services (real-time messaging, presence, support chat and call-center connections).

Our review found no internet-facing path to the vulnerable code in our setup. As a precaution, we deployed the patched release (Node.js 24.22.1) to all affected services on Oct 23 at 7:35 AM ET and added an extra safeguard. After the rollout we monitored for 60 minutes and saw no service errors, restarts or performance change.

There was no service interruption, and there is no indication that our systems were targeted. No action is required on your part.

On Oct 21, 2026, two critical vulnerabilities in the PHP engine (collectively “PHP2Shell,” CVSS 9.2) were publicly disclosed. They allow unauthenticated remote code execution and cross-request memory disclosure, and affected the PHP version in our production environment.

We deployed the patched release (PHP 8.4.27) to all production services the same day at 3:36 PM ET. Following the rollout we monitored for 75 minutes and observed no application errors, no background-job or scheduled-task failures, and normal error rates and response times. All subsequent deployments run on the patched version.

There was no service interruption, and there is no indication that our systems were targeted. No action is required on your part.