Do you have questions about performance or outages? Our friendly Customer Care team can help! Get in touch
Do you have questions about performance or outages? Our friendly Customer Care team can help! Get in touch
We are aware of the critical PHP vulnerabilities recently published (CVE-2026-109618 and CVE-2026-109619) and have been monitoring the situation closely.
Emergency web application firewall rules addressing these vulnerabilities were deployed by Cloudflare on 21-Oct-2026 and are active across our infrastructure. The core Staffbase platform does not use the affected components. A small number of plugins did; these were moved to hardened base images on 21-Oct-2026, and the patched PHP versions have been rolled out to all affected components as of 22-Oct-2026. We have seen no indication of exploitation in our environment.
All systems have been operating normally throughout, and no further action is required.
If you have any questions regarding this topic, please reach out to our support team at support@staffbase.com.
No components marked as affected
Resolved
We are aware of the critical PHP vulnerabilities recently published (CVE-2026-109618 and CVE-2026-109619) and have been monitoring the situation closely.
Emergency web application firewall rules addressing these vulnerabilities were deployed by Cloudflare on 21-Oct-2026 and are active across our infrastructure. The core Staffbase platform does not use the affected components. A small number of plugins did; these were moved to hardened base images on 21-Oct-2026, and the patched PHP versions have been rolled out to all affected components as of 22-Oct-2026. We have seen no indication of exploitation in our environment.
All systems have been operating normally throughout, and no further action is required.
If you have any questions regarding this topic, please reach out to our support team at support@staffbase.com.