Resolved after 6 hours 14 minutes, affecting Activate and Connect and 1 more, on October 21, 2026.
# PHP Vulnerability FAQs ## What happened? The world was alerted to two new very high risk PHP vulnerabilities that were discovered in the PHP basecode; they were rated 9.2 out of 10 on the Common Vulnerability Scoring System which is a framework for communicating the characteristics and severity of software vulnerabilities. At the time of publishing the notice, the only known mitigation, confirmed by PHP, the UK National Cyber Security Centre and the National Cyber Security Center of the Netherlands was to take potentially impacted systems offline to secure them. PHP confirmed a security patch to address the vulnerabilities was coming but wouldn’t be available until 16:00 CEST. Spotler assessed the risk and impact, and decided to take the potentially impacted platforms offline with no prior warning to secure the customer base at the earliest opportunity. ## When will all services be fully back to normal, and how do you know they're working properly? All affected products are back online. Platforms began coming back online from 16:42 CEST, and all platforms were confirmed online and accessible by 21:21 CEST on Wednesday 21st October 2026. We restored them after applying the PHP security patch and verified each one using our standard post-release testing before making it available to customers. You can follow updates on this incident, and be notified of any future ones, by subscribing at [status.spotler.cloud](https://status.spotler.cloud/). If anything isn't working as expected, please raise a ticket with our Support team and we'll investigate straight away. ## What happened to my emails, campaigns, links and integrations while services were offline? Do I need to do anything? Our development teams are reviewing exactly how each product's emails, campaigns, links and integrations were affected during the disruption. Because the impact varies by product, we're preparing detailed, product-specific guidance, including any actions you may need to take. We aim to publish this guidance by the end of Monday 26th October 2026, or sooner if possible. In the meantime, if you have an urgent concern about a specific campaign or integration, please raise a ticket with our Support team and we'll look into it for you. ## Which services were affected, and why were products that don't use PHP also disrupted? The following platforms were affected: Activate, Connect, CRM, FeedbackPro, MailPro, Message, Momice, Search, SendPro and Let's Get Digital. The level of impact varied by platform. Some platforms were taken offline entirely, while others were only partially affected. Some background functions that don't rely on PHP kept running throughout, but the platforms themselves weren't accessible. As a lot of our products communicate to each other, some errors in available/online products were caused by connected elements from unavailable products not being online. ## What has Spotler done to protect customers, and is there any evidence our data was compromised? As soon as the vulnerabilities were identified, we took affected platforms offline as a precaution, following guidance from the UK National Cyber Security Centre and the Dutch National Cyber Security Centre \(NCSC-NL\). All platforms have since been patched in line with the PHP development team's guidance. We have checked all systems and found no evidence of any compromise. We continue to monitor our systems closely. ## Are Spotler's products and integrations still vulnerable to the PHP security issue? No. All products have been patched and confirmed up to date through our standard release procedures. If you use third-party tools, plugins or services external to Spotler, we recommend checking with those providers to confirm whether they were affected. If a similar vulnerability arises in future, we will take the same approach: weigh the risk against the impact on customers, and take platforms offline if that's what is needed to protect you. We're also continuing to improve how we communicate during incidents, and we'll give advance notice of downtime wherever possible. On this occasion, the nature and urgency of the vulnerability meant we couldn't give advance warning.
Affected components
Update timeline
- identified Oct 21, 2026, 12:57 PM UTC
We want to let you know that some Spotler services are temporarily unavailable. Following recently disclosed vulnerabilities affecting PHP, and in line with guidance from the UK National Cyber Security Centre and the Dutch National Cyber Security Centre, we have decided to take some of our systems offline as a precautionary measure. This is not a data breach. We are responding to a known vulnerability, and we have acted early to keep your data and our platforms protected. Our teams are working on a solution, and we will make our systems available again as soon as possible. We know this disruption affects your work, and we’re sorry for the inconvenience. Please subscribe to the status page for further updates. Kind regards, The Spotler team
- identified Oct 21, 2026, 01:01 PM UTC
Additional products added to this ongoing incident.
- identified Oct 21, 2026, 01:06 PM UTC
Additional products added to this ongoing incident.
- identified Oct 21, 2026, 02:07 PM UTC
PHP have released their fix and this is now being deployed. We expect that systems will slowly start to come back online over the next couple of hours.
- identified Oct 21, 2026, 02:42 PM UTC
Activate, Message and Search are back online.
- identified Oct 21, 2026, 02:48 PM UTC
MailPro is back online.
- identified Oct 21, 2026, 03:23 PM UTC
FeedbackPro and Momice are back online.
- identified Oct 21, 2026, 03:48 PM UTC
CRM is back online.
- identified Oct 21, 2026, 04:02 PM UTC
Work is continuing on the remaining services.
- identified Oct 21, 2026, 05:30 PM UTC
Let's Get Digital is back online.
- resolved Oct 21, 2026, 07:12 PM UTC
All platforms are back online.
- postmortem Oct 22, 2026, 12:45 PM UTC
# PHP Vulnerability FAQs ## What happened? The world was alerted to two new very high risk PHP vulnerabilities that were discovered in the PHP basecode; they were rated 9.2 out of 10 on the Common Vulnerability Scoring System which is a framework for communicating the characteristics and severity of software vulnerabilities. At the time of publishing the notice, the only known mitigation, confirmed by PHP, the UK National Cyber Security Centre and the National Cyber Security Center of the Netherlands was to take potentially impacted systems offline to secure them. PHP confirmed a security patch to address the vulnerabilities was coming but wouldn’t be available until 16:00 CEST. Spotler assessed the risk and impact, and decided to take the potentially impacted platforms offline with no prior warning to secure the customer base at the earliest opportunity. ## When will all services be fully back to normal, and how do you know they're working properly? All affected products are back online. Platforms began coming back online from 16:42 CEST, and all platforms were confirmed online and accessible by 21:21 CEST on Wednesday 21st October 2026. We restored them after applying the PHP security patch and verified each one using our standard post-release testing before making it available to customers. You can follow updates on this incident, and be notified of any future ones, by subscribing at [status.spotler.cloud](https://status.spotler.cloud/). If anything isn't working as expected, please raise a ticket with our Support team and we'll investigate straight away. ## What happened to my emails, campaigns, links and integrations while services were offline? Do I need to do anything? Our development teams are reviewing exactly how each product's emails, campaigns, links and integrations were affected during the disruption. Because the impact varies by product, we're preparing detailed, product-specific guidance, including any actions you may need to take. We aim to publish this guidance by the end of Monday 26th October 2026, or sooner if possible. In the meantime, if you have an urgent concern about a specific campaign or integration, please raise a ticket with our Support team and we'll look into it for you. ## Which services were affected, and why were products that don't use PHP also disrupted? The following platforms were affected: Activate, Connect, CRM, FeedbackPro, MailPro, Message, Momice, Search, SendPro and Let's Get Digital. The level of impact varied by platform. Some platforms were taken offline entirely, while others were only partially affected. Some background functions that don't rely on PHP kept running throughout, but the platforms themselves weren't accessible. As a lot of our products communicate to each other, some errors in available/online products were caused by connected elements from unavailable products not being online. ## What has Spotler done to protect customers, and is there any evidence our data was compromised? As soon as the vulnerabilities were identified, we took affected platforms offline as a precaution, following guidance from the UK National Cyber Security Centre and the Dutch National Cyber Security Centre \(NCSC-NL\). All platforms have since been patched in line with the PHP development team's guidance. We have checked all systems and found no evidence of any compromise. We continue to monitor our systems closely. ## Are Spotler's products and integrations still vulnerable to the PHP security issue? No. All products have been patched and confirmed up to date through our standard release procedures. If you use third-party tools, plugins or services external to Spotler, we recommend checking with those providers to confirm whether they were affected. If a similar vulnerability arises in future, we will take the same approach: weigh the risk against the impact on customers, and take platforms offline if that's what is needed to protect you. We're also continuing to improve how we communicate during incidents, and we'll give advance notice of downtime wherever possible. On this occasion, the nature and urgency of the vulnerability meant we couldn't give advance warning.
Your product runs on more than Spotler
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services