PHP2Shell vulnerability: services taken offline as a precaution

21 Oct 2026

Resolved - All products and services are patched and fully operational. Trulyp 1.1.1 is available through the Customer Portal. Security scans showed no signs of abuse. Read our summary of the incident.23:03 CEST

Monitoring - The Customer Portal and our websites are back online after our server vendor confirmed the PHP patch. All patched product versions can be downloaded from the Customer Portal.22:23 CEST

Update - All WriteBackExtreme and MailScheduler SaaS environments are upgraded and running again.21:36 CEST

Update - More WriteBackExtreme and MailScheduler SaaS environments are back online. For the Customer Portal, we are waiting for our server vendor to patch PHP.19:46 CEST

Update - Trulyp 1.1.1 is built and will be released once the Customer Portal is back online.18:21 CEST

Update - WriteBackExtreme 5.7.7 is available on request through our support team.17:50 CEST

Update - MailScheduler 5.1.4 is available. Docker users can upgrade right away; other installations can request it through our support team.17:38 CEST

Update - We are upgrading and checking each WriteBackExtreme SaaS environment one by one.17:30 CEST

Update - WriteBackExtreme 6.3.1 is available. Docker users can upgrade right away; other installations can request it through our support team.17:26 CEST

Update - We are applying the fix across all products and core services. Builds are slower than usual due to high global demand on GitHub's build infrastructure.16:30 CEST

Identified - We verified that the patch resolves the vulnerability and started rolling it out.15:50 CEST

Identified - PHP released a patch for the vulnerability.15:45 CEST

Investigating - As a precaution against the PHP2Shell vulnerability, we have taken our services offline.