RESOLVED: PHP Vulnerability

Update timeline

1. investigating Oct 21, 2026, 01:31 PM UTC

   TOPdesk unaffected by PHP vulnerabilities Following reports of two critical vulnerabilities in PHP, we want to reassure you that TOPdesk does not use PHP. These vulnerabilities therefore do not affect the TOPdesk application, and no action is required for TOPdesk. If your organisation uses PHP in other applications or custom integrations, please follow the PHP security guidance for those systems. To inform TOPdesk you are affected by this issue, please visit https://my.topdesk.com/tas/public/ssp/ . Please refer to incident TDR26 10 5632.

2. investigating Oct 21, 2026, 01:34 PM UTC

   PHP vulnerabilities As reported earlier regarding the two critical vulnerabilities in PHP, none of the TOPdesk product uses PHP. These vulnerabilities therefore do not affect the TOPdesk application, and no action is required for your environment. Some of our external websites do employ PHP however. Therefore, we've decided to temporarily take the following websites offline, until the fix is implemented: - www.topdesk.com - careers.topdesk.com - marketplace.topdesk.com Your my.topdesk access will remain unaffected. If your organization uses PHP in other applications or custom integrations, please follow the PHP security guidance for those systems.

3. resolved Oct 22, 2026, 08:40 AM UTC

   Resolved – PHP vulnerabilities We have applied the PHP security updates addressing the reported vulnerabilities. The affected websites—www.topdesk.com, careers.topdesk.com and marketplace.topdesk.com—are back online. As previously communicated, the TOPdesk application was unaffected. No action is required for your TOPdesk environment. This incident is now resolved. Thank you for your patience, and we apologise for the inconvenience."