Evolve IP incident
PHP critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Evolve IP is currently experiencing a notice incident affecting OBT - Device registrations and IVR application and 1 more component, which began 10h ago. The vendor's full update timeline is below.
Affected components
Update timeline
- investigating Oct 21, 2026, 01:33 PM UTC
On 20 October 2026, the PHP Foundation announced two critical vulnerabilities affecting PHP. The Dutch National Cyber Security Centre (NCSC) has advised organisations to prepare to update affected systems. A security patch is due for release at 16:00 CEST today. We are investigating this issue and reviewing it with each of our vendors to confirm whether any XTIUM services are affected and whether patching is required. We will provide further updates as we know more. For further information, see the NCSC guidance: https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/ncsc-ernstige-kwetsbaarheden-in-php
- investigating Oct 21, 2026, 02:23 PM UTC
As a precautionary measure, the PBX Portal (https://pbxportal.mtel.nl) has been temporarily taken offline until further notice. Should you require any configuration changes, please submit a MACD request via the Selfservice Portal (https://selfservice.xtium.eu).
- investigating Oct 21, 2026, 04:36 PM UTC
Following the disclosure of the PHP vulnerabilities, XTIUM has reviewed its internal systems and applied the necessary mitigating measures where required. We have also engaged all relevant vendors to determine whether any customer-facing services are affected. Based on responses received so far, only one vendor has identified potential exposure and is currently implementing remediation actions. At present, the overall exposure to XTIUM services is considered low. We continue to work with the remaining vendors to complete our assessment and will provide further updates as additional information becomes available.