Is Spencer down?

Dear customer, You may have seen news about two critical security vulnerabilities in PHP, a programming language that is widely used to run websites and web applications. The vulnerabilities, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), could allow attackers to take control of servers that are publicly reachable from the internet. The PHP security team is releasing a fix today, 21 October, at 16:00 Belgian time. We want to let you know where Spencer stands. The servers that run Spencer are not directly reachable from the internet. Every request first goes through a separate security gateway, which only lets it through if it comes from a signed-in user with a valid login. As a result, the automated attacks that are expected to target public PHP servers today cannot reach our systems. This significantly lowers the risk for Spencer. We are still taking this seriously. We will apply the official fix as soon as it is available, and our team is closely monitoring our systems in the meantime. We do not expect any downtime, and you can keep using the app as usual. You do not need to do anything. If you have questions, simply reply to this email or contact our support team. Kind regards, The Spencer team

Investigating We are aware of two critical security vulnerabilities in PHP, known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). PHP is a programming language widely used to run websites and web applications, including parts of Spencer. Our team is investigating the potential impact on our platform. Spencer is available and working normally. We will post an update as soon as we know more.

Resolved The fix for the PHP2Shell vulnerabilities has been installed on all Spencer servers using PHP. Spencer remained available throughout, and no action is needed on your side. We will keep monitoring our systems. This incident is now closed.

## Resolved The fix for the PHP2Shell vulnerabilities has been installed on all Spencer servers using PHP. Spencer remained available throughout, and no action is needed on your side. We will keep monitoring our systems. This incident is now closed.

On 8 August 2026, between approximately 02:07 and 02:09 CEST, some Spencer API requests returned errors. The disruption was caused by a restart of our managed Azure database while Azure applied a database engine update. The database recovered automatically and all services resumed normal operation. We are reviewing additional measures to reduce the impact of future database maintenance.