PHP2Shell security vulnerabilities

Update timeline

1. investigating Oct 21, 2026, 11:10 AM UTC

   Investigating We are aware of two critical security vulnerabilities in PHP, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). PHP is a programming language widely used to run websites and web applications, including parts of Spencer. Our team is investigating the potential impact on our platform. Spencer is available and working normally. We will post an update as soon as we know more.

2. investigating Oct 21, 2026, 12:00 PM UTC

   Identified We have completed our initial assessment. The vulnerabilities could allow attackers to take control of PHP servers that are publicly reachable from the internet. Spencer’s servers are not directly reachable from the internet: requests pass through a separate security gateway first. As a result, the automated attacks expected against public PHP servers today cannot reach our systems, which significantly lowers the risk for Spencer. The PHP security team will release a fix today at 16:00 Belgian time, and we will apply it as soon as it is available. In the meantime, we are closely monitoring our systems. We do not expect any downtime, and you can keep using Spencer as usual.

3. investigating Oct 21, 2026, 05:00 PM UTC

   Update in progress The fix for the PHP2Shell vulnerabilities has been released, and we are installing it on all Spencer servers. We expect to complete this within the next 30 minutes. Spencer stays online during the update, and you can keep using the app as usual.

4. resolved Oct 21, 2026, 05:40 PM UTC

   Resolved The fix for the PHP2Shell vulnerabilities has been installed on all Spencer servers using PHP. Spencer remained available throughout, and no action is needed on your side. We will keep monitoring our systems. This incident is now closed.