Posted 12 days agoOctober 23, 2026 at 2:52 AMUTC
On Oct 21, 2026, two critical vulnerabilities in the PHP engine (collectively “PHP2Shell,” CVSS 9.2) were publicly disclosed. They allow unauthenticated remote code execution and cross-request memory disclosure, and affected the PHP version in our production environment.
We deployed the patched release (PHP 8.4.27) to all production services the same day at 3:36 PM ET. Following the rollout we monitored for 75 minutes and observed no application errors, no background-job or scheduled-task failures, and normal error rates and response times. All subsequent deployments run on the patched version.
There was no service interruption, and there is no indication that our systems were targeted. No action is required on your part.