Skip to content
English
Go back to playipp.com
  • There are no suggestions because the search field is empty.

Security update: PHP vulnerabilities patched

Two vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) affected some of PLAYipp's systems. All systems have now been patched and the issue is resolved. You do not need to do anything. This article describes what happened and the actions we took.

Contents

  1. What happened
  2. Actions we took
  3. Timeline
  4. Current status
  5. Contact and support

What happened

Two vulnerabilities have been discovered in PHP, registered as CVE-2026-109618 and CVE-2026-109619. Some of PLAYipp's systems use PHP and were therefore affected by the issue. All systems have now been patched to fix the vulnerabilities.

Actions we took

As soon as we learned the extent of the problem (Wednesday, October 21 , in the morning CEST), we took every measure available:

  1. Non-essential systems were shut down. Systems that were not essential to operations were temporarily taken offline.
  2. Upload progress and multipart/form-data were disabled. These features were turned off on all remaining systems.
  3. Critical upload functions were kept running. Endpoints that require multipart to function (such as file uploads) remained available. They require login and were judged to be hard to find and exploit before the patches were released.
  4. Monitoring was set up. We added rules to our log system that alert on suspicious traffic.
  5. Systems were patched. As soon as updated packages became available (just before 16:00 CEST), we started patching the systems. Most servers were patched immediately, and the more advanced rollouts were completed by 21:00 CEST.

Timeline

Time (Wednesday, October 21, CEST) Event
Morning The extent of the problem becomes known. Non-essential systems are shut down, upload progress and multipart/form-data are disabled, and monitoring rules are set up.
Just before 16:00 Updated packages become available. Patching begins and most servers are patched immediately.
21:00 The more advanced rollouts are completed.

Current status

All systems are patched and the vulnerabilities are resolved.

You do not need to do anything. We have updated all affected systems and no action is required on your part.

Contact and support

If you have any questions about this security update, please contact our support team at support@playipp.com.