Exonet Status

Resolved: This incident has been resolved.

Monitoring: All updates have now been applied across our platform, including patches and mitigations for end-of-life PHP versions (on a best effort basis).

Applications temporarily taken offline at customer requests have been brought back online, and the affected customers have been notified.

We are monitoring the remaining open items and will provide a further update once these have been addressed.

Investigating: The rollout of the official patches to all supported PHP versions (8.2 through 8.5) has been completed.

We are now focusing on the two remaining steps: lifting the temporary restrictions, and rolling out backported security patches to the remaining end-of-life PHP versions.

We will post another update once the rollout to the end-of-life versions is complete.

Investigating: Due to the PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), our phone lines will remain open for extended hours to assist customers.

Patching is still ongoing across our platform. Now that the patches are rolling out on the supported PHP versions, we are starting to gradually lift the temporary restrictions applied earlier, and we are also beginning to roll out fixes to older PHP versions.

We will post another update once the rollout has been completed. Thank you for your patience.

Investigating: Updated container images with the security patches are now available for PHP 8.2, 8.3, 8.4 and 8.5.

If you run your own containers on our Managed Apps platform, based on our PHP images, we recommend pulling the latest images and redeploying as soon as possible. The rollout across the rest of our platform is still in progress, and we will post another update once it has been completed.

Investigating: The official PHP security patches have now been released. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that can allow unauthenticated remote code execution.

We are currently rolling out these patches across all supported PHP versions on our platform. The rollout is in progress as we speak, and we will update this notice once it has been completed.

The mitigations we applied earlier today, including disabling the PHP session upload progress feature (session.upload_progress.enabled), remain in place during the rollout.

No action is required on your side. If you have any questions or concerns, please do not hesitate to contact our support team. Please note that response times may still be longer than usual due to the high volume of requests.

Investigating: We are currently receiving a high volume of requests from customers asking us to temporarily take down their environments and websites as a precautionary measure in response to the recently announced PHP vulnerability. We are prioritising these requests to ensure they are handled as quickly as possible. As a result, response times for other support tickets may be longer than usual.

We apologise for any inconvenience this may cause and appreciate your patience and understanding while our team works through these requests. We will continue to provide updates as the situation develops.

Investigating: We have now applied mitigations across our platform to reduce the risk of exploitation of the recently announced PHP vulnerability. This includes disabling the legacy PHP session upload progress feature (session.upload_progress.enabled).

Regular file uploads remain unaffected. Only custom applications relying on this feature for upload progress reporting may notice a difference.

Official PHP security patches are expected today at 16:00 CEST. We will roll these out across supported PHP versions as soon as they become available.

No action is required on your side. We will provide another update once the patches have been deployed. If you have any questions or concerns, please do not hesitate to contact our support team.

Investigating: We are aware of a recently announced remote code execution (RCE) vulnerability in PHP. Official details and patches for supported PHP versions are expected to be published today at 16:00. We will roll out these patches as soon as they are available.

Some details of the vulnerability have already leaked ahead of the official release. Based on this information, we are deploying mitigations on our platform right now to reduce the risk of exploitation before the official patches arrive.

As part of these mitigations, we are disabling the PHP session upload progress feature (session.upload_progress.enabled). This is a rarely used, legacy feature that lets a script report the progress of a file upload through the PHP session. File uploads themselves are not affected, and no major frameworks or CMS platforms depend on this feature. The only visible effect would be on custom applications that use it to display an upload progress bar, which may no longer update. If your application relies on this feature, we recommend updating it to use an alternative method for progress reporting or contact our support team.

No action is required on your side at this time. We will update this notice as soon as more information becomes available.

Resolved: This incident has been resolved.

Monitoring: All updates have now been applied across our platform, including patches and mitigations for end-of-life PHP versions (on a best effort basis).

Applications temporarily taken offline at customer requests have been brought back online, and the affected customers have been notified.

We are monitoring the remaining open items and will provide a further update once these have been addressed.

Investigating: The rollout of the official patches to all supported PHP versions (8.2 through 8.5) has been completed.

We are now focusing on the two remaining steps: lifting the temporary restrictions, and rolling out backported security patches to the remaining end-of-life PHP versions.

We will post another update once the rollout to the end-of-life versions is complete.

Investigating: Due to the PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), our phone lines will remain open for extended hours to assist customers.

Patching is still ongoing across our platform. Now that the patches are rolling out on the supported PHP versions, we are starting to gradually lift the temporary restrictions applied earlier, and we are also beginning to roll out fixes to older PHP versions.

We will post another update once the rollout has been completed. Thank you for your patience.

Investigating: Updated container images with the security patches are now available for PHP 8.2, 8.3, 8.4 and 8.5.

If you run your own containers on our Managed Apps platform, based on our PHP images, we recommend pulling the latest images and redeploying as soon as possible. The rollout across the rest of our platform is still in progress, and we will post another update once it has been completed.

Investigating: The official PHP security patches have now been released. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that can allow unauthenticated remote code execution.

We are currently rolling out these patches across all supported PHP versions on our platform. The rollout is in progress as we speak, and we will update this notice once it has been completed.

The mitigations we applied earlier today, including disabling the PHP session upload progress feature (session.upload_progress.enabled), remain in place during the rollout.

No action is required on your side. If you have any questions or concerns, please do not hesitate to contact our support team. Please note that response times may still be longer than usual due to the high volume of requests.

Investigating: We are currently receiving a high volume of requests from customers asking us to temporarily take down their environments and websites as a precautionary measure in response to the recently announced PHP vulnerability. We are prioritising these requests to ensure they are handled as quickly as possible. As a result, response times for other support tickets may be longer than usual.

We apologise for any inconvenience this may cause and appreciate your patience and understanding while our team works through these requests. We will continue to provide updates as the situation develops.

Investigating: We have now applied mitigations across our platform to reduce the risk of exploitation of the recently announced PHP vulnerability. This includes disabling the legacy PHP session upload progress feature (session.upload_progress.enabled).

Regular file uploads remain unaffected. Only custom applications relying on this feature for upload progress reporting may notice a difference.

Official PHP security patches are expected today at 16:00 CEST. We will roll these out across supported PHP versions as soon as they become available.

No action is required on your side. We will provide another update once the patches have been deployed. If you have any questions or concerns, please do not hesitate to contact our support team.

Investigating: We are aware of a recently announced remote code execution (RCE) vulnerability in PHP. Official details and patches for supported PHP versions are expected to be published today at 16:00. We will roll out these patches as soon as they are available.

Some details of the vulnerability have already leaked ahead of the official release. Based on this information, we are deploying mitigations on our platform right now to reduce the risk of exploitation before the official patches arrive.

As part of these mitigations, we are disabling the PHP session upload progress feature (session.upload_progress.enabled). This is a rarely used, legacy feature that lets a script report the progress of a file upload through the PHP session. File uploads themselves are not affected, and no major frameworks or CMS platforms depend on this feature. The only visible effect would be on custom applications that use it to display an upload progress bar, which may no longer update. If your application relies on this feature, we recommend updating it to use an alternative method for progress reporting or contact our support team.

No action is required on your side at this time. We will update this notice as soon as more information becomes available.

Resolved: This incident has been resolved.

Identified: Thanks to the hard work of all our teams, email response times are back to the standard you can expect from us.

Identified: Following up on yesterday's PHP incident (21 October): although the incident has been resolved, it has left us with a backlog of regular requests.

As a result, it may take longer than you are used to before we respond to your ticket. We are working through all requests as quickly as possible and will get back to you. There is no need to submit the same request again, as this may slow things down further.

Is your issue urgent? Then please don't wait for a reply to your ticket, but call us directly. We are always available by phone for urgent matters.

We apologise for the inconvenience and thank you for your patience and understanding.