Last updated: 22 October 2026, 21:10 CEST
This week, a critical security vulnerability was disclosed in PHP, a programming language that runs a large share of the world’s websites and web applications. National cybersecurity agencies, including the UK’s NCSC and the US agency CISA, have urged organisations everywhere to act quickly.
We want to reassure you that we have not been affected, and our teams are continuing to work as normal. As a precaution, we have temporarily switched off some services and are bringing them back online step by step.
What happened
On 21 October 2026, the PHP project released a security update for two vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Under certain conditions, these flaws could let an attacker run commands on a web server running PHP without needing to log in. The vulnerabilities affect PHP across all versions, so organisations worldwide are reviewing their systems.
What we have done
As soon as the vulnerability was disclosed, our security team:
- Identified every system in our environment that uses PHP
- Checked those systems for any signs of unauthorised access, and found none
- Applied the security fixes and protective measures recommended by the PHP project
- Switched off some services as a precaution while we complete our checks
What happens next
We are bringing services back online incrementally. Each one is restored only once we have confirmed it is fully patched and secure. We will update this page as services return.
What this means for you
We have not been affected. We have found no evidence that any of our systems or customer data have been accessed or compromised.
Most services are running as normal. A small number are temporarily offline as a precaution and will return shortly.
Existing customer subscriptions remain intact.
You don’t need to do anything.
Questions?
If you have any questions or concerns, please contact your account manager or our support team at https://apac.hubexo.com/contact/. We will update this page if anything changes.
We will continue to monitor the situation and update this page as more information becomes available.