Staffbase incident

[All Systems] [Security Advisory] – Critical PHP vulnerabilities — no customer-facing service impact

Notice Resolved

Staffbase experienced a notice incident on October 21, 2026, lasting –. The incident has been resolved; the full update timeline is below.

Started
Oct 21, 2026, 07:00 AM UTC
Resolved
Oct 21, 2026, 07:00 AM UTC
Duration
–
Detected by Pingoru
Oct 21, 2026, 07:00 AM UTC

Update timeline

  1. resolved Oct 21, 2026, 02:52 PM UTC

    We are aware of the critical PHP vulnerabilities published today (CVE-2026-109618 and CVE-2026-109619) and have been monitoring the situation closely since this morning. Emergency web application firewall rules addressing these vulnerabilities were deployed by Cloudflare earlier today and are active across our infrastructure. We have seen no indication of exploitation in our environment. The core Staffbase platform does not use the affected components. A small number of plugins do. These have already been moved to hardened base images, and we will roll out the patched PHP versions as soon as they become available in those base images. All systems are operating normally. We will continue to monitor the situation and provide an update if anything changes. If you have any questions regarding this topic, please reach out to our support team at [[email protected]](mailto:[email protected]).