On October 20, 2026, details of two critical vulnerabilities in PHP, known as PHP2shell, were made public. These vulnerabilities could allow an attacker to run code remotely on affected systems. Further information is available in the PHP security announcement (https://www.php.net/archive/2026.php#2026-10-20-1)
Our engineering team responded quickly and applied the patches to all our systems as soon as the patches were released. Our services kept running normally throughout, with no downtime or impact for our customers. We also reviewed our traffic for the whole of October 2026 and found no evidence of suspicious activity or misuse linked to these vulnerabilities. We’ll keep monitoring and will post here if anything changes.
We recommend that you also check whether your own systems or third-party services use PHP, and apply the latest security updates from PHP and your software providers.
Posted Oct 22, 2026 - 13:14 CEST
This incident affected: API, Checkout & Other Widgets, ChurnIQ, Website, Developers Portal, Help Center, and Sandbox.