TapClicks incident
Industry-Wide PHP Security Vulnerability: TapClicks Proactive Maintenance
TapClicks experienced a notice incident on October 21, 2026 affecting TapAnalytics/TapReports and TapOrders/TapWorkflow, lasting 8h 27m. The incident has been resolved; the full update timeline is below.
Affected components
Update timeline
- identified Oct 21, 2026, 05:35 AM UTC
On October 20, the PHP security team issued advance notice of two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10 for severity (Remote Code Execution). Upstream maintainers have scheduled an emergency security release for today, October 21, at 14:00 UTC / 10:00 AM EDT. Given the severity of these vulnerabilities and public discussions surrounding leaked exploit details prior to the official patch release, we made the deliberate decision to take the TapClicks platform temporarily offline until the vendor fix can be applied. This proactive isolation is consistent with guidance from leading cybersecurity advisories, including CERT-EU Advisory 2026-018. What's Affected: The core TapClicks application is currently unavailable. Data processing queues and daily data loads will automatically resume processing sequentially once platform service is restored. Next Steps: We will deploy the security patch as soon as possible upon release by the PHP security team, complete environment integrity checks, and restore full service. We will post our next update by 7:30 AM Eastern, or sooner as new information becomes available. We apologize for the disruption to your workday and appreciate your understanding as we prioritize platform security. For urgent inquiries, please contact our support team at [email protected].
- identified Oct 21, 2026, 08:33 AM UTC
Our teams are working around the clock to prepare for the release of the official PHP security patch and monitor any developments. We will provide more updates as they become available.
- identified Oct 21, 2026, 12:01 PM UTC
Our engineering teams remain on active standby as we prepare for the official upstream PHP security release, scheduled for 10:00 AM Eastern (14:00 UTC) today. Upon release, we anticipate a deployment, verification, and testing window of approximately two hours before bringing core application services back online. To ensure environment stability, platform access and data processing queues will be restored gradually as service checks complete. We appreciate your patience and will provide our next status update around 10:30 AM Eastern, as new information becomes available.
- identified Oct 21, 2026, 01:15 PM UTC
We are continuing to work on a fix for this issue.
- resolved Oct 21, 2026, 02:03 PM UTC
Ongoing communication about this issue will be covered under the incident "Worldwide PHP Security Event: How TapClicks Is Protecting You"