Critical incident

bexio AG: Security update: bexio temporarily paused

Affected: bexio Website, bexio Office, bexio Cockpit, Payroll, Kontera, API, Banking / Fetch transactions

Current status of bexio AG: Operational — live bexio AG status

Timeline

1. Oct 21, 2026, 09:08 UTC
   investigating
   Due to a critical, worldwide security vulnerability in PHP, the programming language we use, we have taken bexio offline as a precautionary measure. The most important thing first: your data is safe. We currently expect to be able to roll out the security update later today. So that we can focus entirely on the technical fix, we kindly ask you not to contact support in any way for the time being. We will keep you posted. (UPDATE – 21 October 2026 – 12:29)
2. Oct 21, 2026, 10:43 UTC
   investigating
   We are continuing to investigate this issue.
3. Oct 21, 2026, 10:57 UTC
   investigating
   We are continuing to investigate this issue.
4. Oct 21, 2026, 11:32 UTC
   investigating
   We are continuing to investigate this issue.
5. Oct 21, 2026, 11:38 UTC
   investigating
   We are continuing to investigate this issue.
6. Oct 22, 2026, 05:57 UTC
   resolved
   bexio is fully up and running again: The security update required to resolve the critical, global PHP vulnerability has been successfully deployed. bexio is once again fully available to you with all features.

Updates as published by bexio AG (original).