Exonet incident
Deployment of mitigations and patches for PHP RCE (CVE-2026-109618 / CVE-2026-109619)
Exonet is currently experiencing a notice incident affecting Compute and Managed Apps, which began 5h ago. The vendor's full update timeline is below.
Affected components
Update timeline
- investigating Oct 21, 2026, 06:21 AM UTC
We are aware of a recently announced remote code execution (RCE) vulnerability in PHP. Official details and patches for supported PHP versions are expected to be published today at 16:00. We will roll out these patches as soon as they are available. Some details of the vulnerability have already leaked ahead of the official release. Based on this information, we are deploying mitigations on our platform right now to reduce the risk of exploitation before the official patches arrive. No action is required on your side at this time. We will update this notice as soon as more information becomes available.
- investigating Oct 21, 2026, 07:31 AM UTC
We have now applied mitigations across our platform to reduce the risk of exploitation of the recently announced PHP vulnerability. This includes disabling the legacy PHP session upload progress feature (session.upload_progress.enabled). Regular file uploads remain unaffected. Only custom applications relying on this feature for upload progress reporting may notice a difference. Official PHP security patches are expected today at 16:00 CEST. We will roll these out across supported PHP versions as soon as they become available. No action is required on your side. We will provide another update once the patches have been deployed. If you have any questions or concerns, please do not hesitate to contact our support team.