On 20 October, details of two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”) leaked before a fix was available. PHP runs a large share of the world’s websites and web applications, including parts of our own platform, so we treated this as a priority incident from the moment it emerged.
We were able to update all services that rely on PHP to patched versions within an hour of the patches becoming available, ensuring minimal disruption to our customers and ensuring their data remained safe and secure.
Here’s what we did:
- Protected our systems before the fix existed. On the morning of 21 October, before the official patch was released, we put protective measures in place across our internet-facing services based on information available at the time.
- Patched everything on day one, within one hour. PHP released its fixes on 21 October at 14:50, and every Exacom server and service was updated prior to 16:00 the same day.
- Checked for any sign of compromise. We reviewed our logs and systems back to early August, in line with the latest security guidance, and found no evidence that any Exacom server or service was compromised.
- Kept you informed and protected your data. Full backups were taken before any changes in line with our incident response plans, and users were kept up to date throughout. Most services ran as normal, apart from a short, planned interruption to our services while the fixes went in.
- No action was required for our customers. All customers’ systems received the update at the same time with no intervention needed from our customers.