We wanted to provide an update regarding the recently disclosed PHP security vulnerabilities, the proactive measures we took to protect our platform, and the successful deployment of security patches.
On the evening of 20 October, the PHP development team announced that two security vulnerabilities had been identified, with further details and patched versions scheduled for release at 14:00 UTC on 21 October. At that stage, no specific details of the vulnerabilities or official mitigation guidance had been made available.
Proactive Mitigation
On the morning of 21 October, ahead of the official disclosure, our engineering team began investigating and implementing precautionary measures based on emerging guidance and recommendations from trusted security professionals and the wider PHP development community.
By 13:00 UTC, we had deployed additional security mitigations across our infrastructure, including updates to Web Application Firewall (WAF) rules, PHP configuration settings, and other precautionary measures designed to reduce potential exposure.
Patch Deployment
Following the official disclosure at 14:00 UTC, our focus shifted to deploying the newly patched PHP versions as soon as they became available through our upstream infrastructure providers.
Between 15:00 and 18:00 UTC, our engineering team tested and deployed the necessary infrastructure updates, ensuring that all PHP applications were running fully patched versions by 18:00 UTC on 21 October.
Platform Availability and Security
While the platform remained available throughout this process, one of the precautionary security measures temporarily affected the ability of a small number of customers to save new/updated templates. This was identified at 15:00 UTC, and a fix was deployed and verified in production by 16:00 UTC.
Aside from this limited disruption, the platform remained operational throughout the mitigation and patching process, with no wider service interruption.
Importantly, we have found no evidence that any of our systems were compromised as a result of these vulnerabilities.
Security remains a key priority for us, and we will continue to monitor developments and apply any further recommendations as necessary.
We wanted to share this update to provide transparency and reassurance about the steps taken to protect our platform and your data.