All of our services are fully back online, patched, and operating normally. Following the release of the official upstream PHP security fixes for vulnerabilities CVE-2026-109618 and CVE-2026-109619, our team deployed the updates across our entire infrastructure.
No customer data was accessed or compromised, post-incident forensic analysis confirmed zero traces of malicious activity, and you do not need to take any action.
What happened
On the evening of 20 October, the global PHP project announced two critical, unauthenticated remote execution vulnerabilities affecting the core PHP runtime worldwide.
Because PHP powers a substantial portion of modern web platforms—including parts of our application stack—this triggered an immediate, high-priority industry response. By the morning of 21 October, technical details and weaponized exploit chains had leaked into the public domain ahead of the official patch schedule, exposing unpatched systems to automated scanning across the open internet.
Our response: Two initial mitigations - and why we chose to act further
During the morning hours, security advisories across the industry suggested two preliminary mitigation measures (runtime configuration adjustments and edge filtering). Our engineering team immediately applied both measures across our environment.
However, intelligence evolved rapidly:
- Within hours, security research and core PHP developers confirmed that these workarounds did not provide 100% protection against alternative exploit paths.
- Weaponized exploits circulating online demonstrated that threat actors could potentially bypass these early mitigations.
- Because the vulnerability operates at the engine intake level—before traditional login checks or web application logic can intervene—systems could be probed and exploited directly from the open web.
Faced with this reality, we had to make a choice: leave your data in a potentially vulnerable state while hoping a partial workaround held up, or proactively take our public services offline until a verified fix was applied.
We chose to be safe rather than sorry.
We were among the very first in the industry to make the decisive call to proactively isolate our public-facing services. As the day progressed, major enterprise platforms, government bodies, and infrastructure providers followed the same defensive playbook.
What we did while offline
- Complete surface isolation: Severing public web ingress instantly closed the attack surface, rendering the circulating zero-day exploits completely harmless against our servers.
- Deep forensic analysis: With services safely isolated, our security team performed exhaustive analysis across our web server logs, runtime metrics, and system telemetry. This confirmed that there were zero signs or traces of the known exploits, unauthorized access, or malicious activity across our infrastructure.
- Swift patch deployment and staged recovery: The moment the official upstream PHP patches were published around 17:00 EEST, our team immediately applied the updates and verified pipeline health. Services were sequentially restored in a controlled, phased rollout starting at 17:15, with all systems fully operational and verified by 20:20.
What this means for you: Your data is safe
- Zero impact on customer data: Your accounts, mailing lists, recipient data, and system configurations remained fully protected and untouched throughout the event.
- Full functionality restored: All platforms, login gateways, background queues, and file upload features are running normally.
- No action required on your end: Because all mitigations and updates were handled at the infrastructure level, no password resets, API key rotations, or configuration changes are necessary.
Our apology and our commitment
We sincerely apologize for the disruption and the short notice earlier today. Proactively taking systems offline during business hours is an extreme measure, but when the choice is between temporary downtime and the integrity of your data, we will always choose your security without hesitation.
Our teams demonstrated that we were up to the task: we adapted to live zero-day intelligence within minutes, eliminated the risk before attackers could act, and brought our platforms back up securely the moment official fixes landed.
Need assistance?
If you have any questions regarding your account or need help checking on a scheduled delivery, our support team is available at support@lianatech.com.
Best,
Tuomas Lempiäinen
Chief Technology Officer, Liana Technologies
