Emergency security maintenance – PHP security update "PHP2Shell"

Update timeline

1. identified Oct 21, 2026, 01:42 PM UTC

   On Wednesday, October 21, at 10:00 AM EDT (14:00 UTC), we will apply an emergency security update to our servers. The PHP project is releasing fixes today for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). These are remote code execution flaws in PHP itself, rated 9.2 on the CVSS v4.0 scale. PHP powers roughly 7 in 10 websites, and the issue is being treated as an industry-wide emergency. We are applying the update as soon as it is released to keep the InEvent platform and your data secure. What to expect: to apply the patch safely, we may put the platform into maintenance mode until the update is complete. During this time, the InEvent platform, API, event pages and apps may be temporarily unavailable or slower than usual. Events running during this window may be affected. We’ll keep the maintenance window as short as possible and post updates here as work progresses. Subscribe to this page for notifications. If you have an event running today and need help, contact our support team. For more information about the PHP security release, visit php.net.

2. identified Oct 21, 2026, 01:52 PM UTC

   The fix is currently being applied and we shall resume shortly.

3. resolved Oct 22, 2026, 01:14 PM UTC

   This incident has been resolved.