Resolved after 6 hours 30 minutes, affecting Spencer platform (Spencer API), on October 21, 2026.
Resolved The fix for the PHP2Shell vulnerabilities has been installed on all Spencer servers using PHP. Spencer remained available throughout, and no action is needed on your side. We will keep monitoring our systems. This incident is now closed.
Affected components
Update timeline
- investigating Oct 21, 2026, 11:10 AM UTC
Investigating We are aware of two critical security vulnerabilities in PHP, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). PHP is a programming language widely used to run websites and web applications, including parts of Spencer. Our team is investigating the potential impact on our platform. Spencer is available and working normally. We will post an update as soon as we know more.
- resolved Oct 21, 2026, 05:40 PM UTC
Resolved The fix for the PHP2Shell vulnerabilities has been installed on all Spencer servers using PHP. Spencer remained available throughout, and no action is needed on your side. We will keep monitoring our systems. This incident is now closed.
Your product runs on more than Spencer
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services