On 21 October 2026, two critical PHP vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed. We took immediate action to protect our platform and customer environments.
Your Alumio environment is protected, and no action is required from you.
What we did
Proactive protection before public disclosure
We took proactive steps to protect all Alumio-managed environments against these vulnerabilities. Cloudflare’s firewall rules designed to block malicious requests were active across our platform before the vulnerabilities were publicly disclosed on 21 October 2026. Where needed, we enabled Cloudflare protection for customer environments.
Security updates applied promptly
As soon as the relevant security updates became available from PHP and Ubuntu, we applied them to all Alumio environments. The updates were rolled out using planned maintenance windows. All affected environments were back online on the same day.
Thorough security review
Following the updates, we reviewed our monitoring data from 15 October 2026 onwards to identify any potential signs of exploitation. This included Cloudflare firewall events and application error tracking.
What we found
Our review found no evidence that these vulnerabilities had been exploited in Alumio-managed environments. We also found no indication that customer data had been accessed as a result.
Our ongoing commitment to security
We continuously monitor security advisories affecting the technologies our platform relies on and apply critical security updates as soon as they become available.
We take a proactive approach to security by continuously monitoring emerging threats, applying critical security updates promptly and taking action to protect our customers. We remain committed to maintaining a secure and reliable platform and keeping our customers informed about security issues that may affect them.
If you have any questions about your environment, please contact [email protected] or reach out to your Customer Success Manager.