As of this time, the vulnerability has been patched, and we can confirm nobody was able to access our systems.

We are currently responding to a critical security vulnerability affecting PHP versions used on infrastructure hosting some of our services. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026, and can potentially allow remote code execution on affected servers.

As a precaution, certain services have been taken offline while we apply security patches and review our affected infrastructure. We are treating this incident with the highest priority and will restore services once we have confirmed that the necessary updates have been applied.

At this time, our initial checks have not identified unauthorized access to our systems. We are continuing to review our infrastructure, and our existing security measures include encryption of data at rest and in transit.

We understand that service interruptions are frustrating, and we appreciate your patience while we take the necessary steps to protect our infrastructure and user data.

We will provide another update once patching is complete and services are ready to return.