Spencer incident
PHP security vulnerabilities (PHP2Shell): what this means for Spencer
Resolved on October 21, 2026, affecting section-338194 (Spencer API).
Dear customer, You may have seen news about two critical security vulnerabilities in PHP, a programming language that is widely used to run websites and web applications. The vulnerabilities, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), could allow attackers to take control of servers that are publicly reachable from the internet. The PHP security team is releasing a fix today, 21 October, at 16:00 Belgian time. We want to let you know where Spencer stands. The servers that run Spencer are not directly reachable from the internet. Every request first goes through a separate security gateway, which only lets it through if it comes from a signed-in user with a valid login. As a result, the automated attacks that are expected to target public PHP servers today cannot reach our systems. This significantly lowers the risk for Spencer. We are still taking this seriously. We will apply the official fix as soon as it is available, and our team is closely monitoring our systems in the meantime. We do not expect any downtime, and you can keep using the app as usual. You do not need to do anything. If you have questions, simply reply to this email or contact our support team. Kind regards, The Spencer team
Affected components
Update timeline
- resolved Oct 21, 2026, 12:52 PM UTC
Dear customer, You may have seen news about two critical security vulnerabilities in PHP, a programming language that is widely used to run websites and web applications. The vulnerabilities, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), could allow attackers to take control of servers that are publicly reachable from the internet. The PHP security team is releasing a fix today, 21 October, at 16:00 Belgian time. We want to let you know where Spencer stands. The servers that run Spencer are not directly reachable from the internet. Every request first goes through a separate security gateway, which only lets it through if it comes from a signed-in user with a valid login. As a result, the automated attacks that are expected to target public PHP servers today cannot reach our systems. This significantly lowers the risk for Spencer. We are still taking this seriously. We will apply the official fix as soon as it is available, and our team is closely monitoring our systems in the meantime. We do not expect any downtime, and you can keep using the app as usual. You do not need to do anything. If you have questions, simply reply to this email or contact our support team. Kind regards, The Spencer team
Your product runs on more than Spencer
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services