Felix incident
PHP security vulnerability (CVE-2026-109618 and CVE-2026-109619) - Emergency Patch
Resolved after 15 hours 30 minutes, on October 21, 2026.
On 21 October 2026, the Australian Cyber Security Centre (ACSC) issued a notification about two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). Both Felix and Nexvia use PHP in our technology stack, and both platforms are now patched. Timeline 21 Oct 2026: ACSC issues its notification. We were aware of the vulnerabilities from that point. 21 Oct 2026, 14:00 UTC: PHP releases fixes for both vulnerabilities. 22 Oct 2026, 2:00 am AEST: Our engineering team starts implementing the patch with our cloud infrastructure provider. 22 Oct 2026, before 5:30 am AEST: Fix completed for Nexvia. 22 Oct 2026, before 3:30pm AEST: Fix deployed to production for Felix. What this means for you You don’t need to do anything. The update was applied on our side, and the production environments for both the Felix and Nexvia platforms continued to be available throughout. Thank you Thanks for your patience while the team worked through this, and for giving us the space to focus on getting it done. If you have questions about this update, or need information for your own compliance records, please get in touch with [email protected] and we’ll be happy to help.
Update timeline
- resolved Oct 22, 2026, 06:00 AM UTC
On 21 October 2026, the Australian Cyber Security Centre (ACSC) issued a notification about two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). Both Felix and Nexvia use PHP in our technology stack, and both platforms are now patched. Timeline 21 Oct 2026: ACSC issues its notification. We were aware of the vulnerabilities from that point. 21 Oct 2026, 14:00 UTC: PHP releases fixes for both vulnerabilities. 22 Oct 2026, 2:00 am AEST: Our engineering team starts implementing the patch with our cloud infrastructure provider. 22 Oct 2026, before 5:30 am AEST: Fix completed for Nexvia. 22 Oct 2026, before 3:30pm AEST: Fix deployed to production for Felix. What this means for you You don’t need to do anything. The update was applied on our side, and the production environments for both the Felix and Nexvia platforms continued to be available throughout. Thank you Thanks for your patience while the team worked through this, and for giving us the space to focus on getting it done. If you have questions about this update, or need information for your own compliance records, please get in touch with [email protected] and we’ll be happy to help.
Your product runs on more than Felix
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services