Last updated: October 22, 2026 @ 12:57 UTC

Current status Work Completed — All SimpleRisk hosted instances have been fully patched to the latest PHP version, updated to the new SimpleRisk 20261020-001 release and are fully online. The incident is closed and no further updates will be provided.

What happened

On 20 October 2026 the PHP project announced two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. They could allow remote code execution without authentication. Details leaked before the planned disclosure and a proof-of-concept exploit is publicly available. PHP is scheduled to release fixed versions on 21 October 2026 at 14:00 UTC. At the time of writing, PHP has not confirmed which versions are affected.

Who is affected

SimpleRisk is built on PHP, so any SimpleRisk deployment running an unpatched PHP is potentially affected, including our hosted service. This is a flaw in PHP, not in SimpleRisk's own code.

What we are doing

  • DONE Assessed every hosted SimpleRisk environment (shared Kubernetes, enterprise servers and dedicated deployments) for exposure.
  • DONE As a precaution, temporarily took hosted instances offline so the vulnerable component cannot be reached while a fix is prepared.
  • DONE Reviewed all system logs for signs of exploitation and found no issues.
  • DONE We received the updated version of the Apache PHP Docker image that all SimpleRisk Docker containers are built from.
  • DONE Docker image has been rebuilt with the patched version of PHP.
  • DONE Updating our servers on the fixed PHP.
  • DONE Restoring access environment by environment after each is patched and verified.

What you need to do

Hosted customers

Nothing. We will update this page as access is restored. Your instance's data and configuration are not being changed by this precaution.

Self-hosted customers

Update PHP to the fixed version as soon as it is available for your platform. Treat internet-facing instances as the highest priority.

Until you can patch, consider blocking multipart/form-data POST requests at your web server or WAF. This breaks file uploads, so remove the block after patching.

PHP 8.1 and older are end-of-life and are not expected to receive an official fix. Upgrade them to a supported PHP version. The current release of SimpleRisk supports PHP 8.3 or later.

Event Timeline (UTC)

  • A Hacker News post reports two upcoming PHP remote code execution disclosures.
  • PHP announces a critical security release. watchTowr confirms the leak.
  • A PHP core developer says patching is the only mitigation.
  • Cloudflare reports early attacks and deploys WAF rules.
  • The PHP Foundation warns that Remi's repository will not have updates today.
  • Tweakers, Tweede Kamer, NCSC and Security.NL are reported offline.
  • We begin assessing exposure across all hosted environments.
  • Scheduled PHP security release is live.

SimpleRisk Updates

  • 13:47 UTC — Published page and working on taking services offline
  • 14:28 UTC — Began deploying ACLs to all SimpleRisk Hosted instances to temporarily bring them offline.
  • 14:32 UTC — Confirmed that all SimpleRisk Hosted instances are offline.
  • 15:48 UTC — We are seeing the new Apache PHP version tags on their DockerHub, which indicates that it shouldn't be much longer before those new images are live and we can begin efforts to update our images.
  • 15:52 UTC — Concluded log review of all hosted instances and determined that there is no evidence of exploitation for any customer instances.
  • 16:00 UTC — Began deploying the updated Apache PHP packages to systems not dependent upon the Docker updates.
  • 16:49 UTC — Confirmed with the PHP Docker team that the PHP 8.5.12 tags still have not been pushed. We continue to wait for the official patch to be release.
  • 16:53 UTC — The official Docker is now available from PHP and we are able to start our build process.  Expect this to take 2 hours due to the emulation used to compile for arm 64 architecture.
  • 17:20 UTC — All legacy systems with dedicated EC2s have been patched and are back online.
  • 18:15 UTC — Finished recompiling the SimpleRisk 20261020-001 Docker with the PHP fix.
  • 18:40 UTC — Recompiled Docker successfully deployed to the development environment.
  • 22:46 UTC — All SimpleRisk hosted customers should now be patched, at the latest release and available.  
  • 10/22 @ 09:51 UTC — The remaining trial tier customers are patched, updated to the latest SimpleRisk release and online.

Contact

Questions? Email support@simplerisk.com.