In short
There are no indications that our customers’ services or data have been affected.
The official PHP security patch has been applied and additional security rules are active.
The Coosto platform remains fully functional and safe to use.
General information and impact
What happened?
On 21 October 2026, two critical Remote Code Execution (RCE) vulnerabilities were disclosed in the core of the PHP runtime, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
Because these vulnerabilities are in PHP itself and do not depend on specific application code, all PHP versions from recent years were potentially vulnerable.
Does Coosto use PHP?
Yes, a limited number of components and supporting services within our platform use PHP (directly or indirectly).
Have Coosto’s services or customer data been affected?
No. Our extensive security investigation, log analyses and automated monitoring have shown no indications that our customers’ services or data have been compromised.
Measures, patching and security
What has Coosto done to protect the platform?
Our Security and Engineering teams immediately carried out a coordinated action plan to secure the platform on multiple levels:
WAF protection (existing perimeter security)
Our network is protected by a Web Application Firewall by default. When the incident was disclosed, specific mitigation rules and Response Firewall controls were activated immediately, so suspicious requests are blocked at the edge of our network.Server configuration mitigation
In parallel with our existing network security, specific configuration changes were made at server level right away to rule out possible attack vectors.Patching of core services
The primary production services and core components were immediately updated with the official PHP security patch and successfully deployed.
What temporary control measures have been taken?
In addition to the automatically updated rules within our existing WAF infrastructure, additional server restrictions have been activated. Possible exploitation attempts are automatically detected and blocked at WAF level before they can reach the underlying infrastructure.
Have any indicators of exploitation been found?
No. Our Security and Operations teams have not observed any indicators of exploitation or unauthorised access in the Coosto environment.
Impact on features and external integrations
Will I notice anything from this incident in Coosto?
The Coosto platform itself remains fully functional and safe to use.
Precautionary measures taken by external suppliers and partners may temporarily affect specific integrations. For example, external parties may decide to temporarily disable their own services for preventive maintenance or updates.
Where can I find the current status of external services?
We keep the status of external integrations and affected services up to date in this article: PHP vulnerability updates
Contact and questions
For specific questions about IT security or more information about our incident management process, please contact your Customer Success Manager or our Security Team at [email protected].