PHP2Shell: a summary of our response.
Merlijn Buit, CTO
On 21 October 2026, a critical vulnerability in PHP, known as PHP2Shell, was disclosed. Because PHP is part of our infrastructure, we took our services offline as a precautionary measure while we assessed the impact. Throughout the incident, we kept customers informed through our status page (status.infotopics.com).
PHP released a patch the same afternoon. We verified it, applied it to all affected products and services, and restored our systems in stages. By the end of the day, WriteBackExtreme, MailScheduler, our SaaS environments, the Customer Portal and our websites were all running on patched versions. Trulyp was released last, once the Customer Portal was available again.
We have run security scans across our systems. These showed no signs of abuse or exploitation of the vulnerability.
I would like to thank our customers for their patience and understanding, and our team for their careful work under pressure.
Timeline
Below is a summary of the updates published on our status page. All times are in CEST.
Communication during the incident
Throughout the incident, we published updates on a dedicated status page at status.infotopics.com. Each update included a timestamp and the status of every affected product, including the moments when we could not yet provide an estimated time of recovery.
Interaction with our customers was excellent throughout the day. Many of them responded quickly themselves, taking their on-premises installations offline until the patched versions were available. That swift, shared response helped limit the risk for everyone involved.
Our approach to security
Security is a core principle in how we design and operate our products. Taking services offline has a direct impact on our customers, and it is not a decision we take lightly. In this case, a temporary interruption was preferable to the risk of running vulnerable systems.
Our response was guided by four principles:
Why your choice of vendor matters
Incidents like PHP2Shell are not unique. Modern software is built on many layers of third-party components, and new vulnerabilities are discovered in them regularly. The question is not whether this will happen again, but how prepared you are when it does.
At that moment, it matters who takes responsibility for your software: who monitors new vulnerabilities, who assesses their impact, who builds and verifies updates, and who keeps users informed in the meantime. Those responsibilities continue long after the software is first delivered, whether it runs as SaaS, in Docker, or in a self-hosted environment.
That ongoing responsibility is worth considering when choosing the software your business depends on.
Merlijn Buit
CTO, Infotopics | Apps for Tableau
