Is Knak down?

Our Engineering and Security teams are responding to PHP2SHELL, a recently disclosed vulnerability in widely used web software, including components Knak relies on. We are actively monitoring our systems and applying protective measures. Protecting your data comes first. If we see a threat that needs further action, we may take Knak offline temporarily, possibly with little advance notice. We know any disruption affects your team’s ability to build and launch campaigns. We apologize for the inconvenience and will post updates on our status page as they become available.

We're actioning a patch

We're actioning a patch.

We’ve applied the patch and are currently testing it before bringing Knak back online. Our preliminary investigation has shown no indication that Knak has been compromised. We’ll let you know as soon as Knak is back up.

The issue has been identified and a fix is being implemented.

A fix has been implemented and we are monitoring the results.

We are continuing to monitor for any further issues.

We are continuing to monitor for any further issues.

This incident has been resolved.

## Summary On October 21, 2026, we took the Knak platform, including Knak Send, offline for about two hours as a precaution. Two critical vulnerabilities had been announced in PHP, the programming language that runs much of the web, including parts of Knak. The issue was in PHP itself, not in Knak's code. We applied the fix the same morning, then reviewed our systems for any sign the vulnerabilities had been used against us. We found no evidence that these vulnerabilities were exploited against Knak, and no evidence of unauthorized access to customer data. No action is required on your part. ## Timeline \(Eastern Time\) * **October 20:** The PHP security team announced two critical vulnerabilities \(CVE-2026-109618 and CVE-2026-109619\), known as "PHP2Shell", with a fix to follow. * **October 21, about 9:30 a.m.:** We took the Knak platform and Knak Send offline as a precaution while we applied the fix. * **About 11:45 a.m.:** Service restored, running the patched version of PHP. ## What we reviewed Our DevOps and security teams reviewed activity from October 19, the day before the vulnerabilities became public, through the time the patch was applied and compared it against normal activity from the preceding weeks. The review covered: * Firewall, load balancer and web server logs. * Application logs, errors and performance monitoring. * Application security detections. * Outbound network traffic. * Cloud account activity and credential use, reviewed from early October through October 22. ## What we found * No requests matching the PHP2Shell attack pattern against production. * No server crashes, unusual memory use or unexpected outbound traffic. * No unusual activity on Knak's cloud hosting or identity provider accounts. ## Additional steps we took * Rotated production cloud access keys as a precaution. * Applied additional hardening recommended by the PHP project. ## What you need to do No action is required. We apologize for the disruption to your service. Given the severity of these vulnerabilities, we chose to take the platform offline until the fix was in place, rather than risk exposing your data. If you have any questions, please reach out to your Customer Success Manager or [[email protected]](mailto:[email protected]).