No impact incident

CC: PHP Vulnerability announced - Upload capabilities disabled

Current status of CC: Operational — live CC status

Timeline

1. Oct 21, 2026, 11:53 UTC
   identified
   As a precaution, we have temporarily disabled upload functionality on the community. During this time, members will not be able to upload files, including inline images, profile avatars, and post attachments. All other community functionality, including reading, posting, and replying, is unaffected. We have not seen any impact to customer data or community availability. We expect to restore uploads once our work is complete and will update this page as soon as we have more information.
2. Oct 21, 2026, 12:34 UTC
   identified
   We are continuing to work on a fix for this issue.
3. Oct 21, 2026, 12:40 UTC
   identified
   We are continuing to monitor the platform closely. Our investigation has found no evidence that the security issue we are addressing was exploited. File uploads remain temporarily disabled as a precaution, and we are working to restore them as soon as possible. We will keep this page updated as the situation evolves.
4. Oct 21, 2026, 12:59 UTC
   identified
   We are continuing to work on a fix for this issue.
5. Oct 21, 2026, 13:00 UTC
   identified
   PHP vulnerability (PHP2Shell): uploads temporarily disabled Gainsight Customer Communities uses PHP. On October 20, two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell) were disclosed ahead of the official fix. The PHP security team is releasing the fix today, October 21, at 16:00 CEST (14:00 UTC). What we’ve done: Disabled all file uploads across all communities, including inline images, profile avatars and post attachments. Put additional firewall protections in place against the type of request used in these attacks. Reviewed our logs for signs of exploitation. So far, we’ve found no evidence the vulnerability was exploited on our platform. What happens next: We’ll apply the PHP security update across our EMEA and US infrastructure as soon as it’s released. After patching, we’ll run a full compromise review and share the outcome here. We’ll restore uploads once the patch is applied and verified. Reading, posting and replying work as normal. Our next update will be by 17:00 CEST, or sooner if anything changes.
6. Oct 21, 2026, 14:07 UTC
   identified
   We are continuing to work on a fix for this issue.
7. Oct 21, 2026, 14:08 UTC
   identified
   Update: The PHP security team has released the fix. We are now validating it and testing it against our platform. We will deploy it across our EMEA and US infrastructure once testing is complete. File uploads remain temporarily disabled until the fix is deployed and verified. Our monitoring continues to show no evidence that the vulnerability was exploited on our platform. Reading, posting and replying continue to work as normal. Our next update will be by 5PM CEST, or sooner if anything changes.
8. Oct 21, 2026, 15:30 UTC
   identified
   Update: We are testing the released fix to ensure we don't introduce any regressions. File uploads remain temporarily disabled until the fix is deployed and verified. Our monitoring continues to show no evidence that the vulnerability was exploited on our platform. Reading, posting and replying continue to work as normal. Our next update will be by 6PM CEST, or sooner if anything changes.
9. Oct 21, 2026, 16:00 UTC
   identified
   Update: We are testing the released fix to ensure we don't introduce any regressions. File uploads remain temporarily disabled until the fix is deployed and verified. Our monitoring continues to show no evidence that the vulnerability was exploited on our platform. Reading, posting and replying continue to work as normal. Our next update will be by 7PM CEST, or sooner if anything changes.
10. Oct 21, 2026, 17:00 UTC
    identified
    Update: We are completing the testing in staging before deploying to production. File uploads remain temporarily disabled until the fix is deployed and verified. Our monitoring continues to show no evidence that the vulnerability was exploited on our platform. Reading, posting and replying continue to work as normal. Our next update will be by 8:30PM CEST, or sooner if anything changes.
11. Oct 21, 2026, 18:53 UTC
    monitoring
    Update: The PHP security fix has been deployed to production and we are continuing to monitor closely. We have found no evidence that the vulnerability was exploited on our platform. File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Next update by 08:00AM CEST, or sooner if anything changes.
12. Oct 22, 2026, 06:00 UTC
    monitoring
    Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Next update by 10:00AM CEST, or sooner if anything changes.
13. Oct 22, 2026, 08:00 UTC
    monitoring
    Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Next update by 12:00PM CEST, or sooner if anything changes.
14. Oct 22, 2026, 10:00 UTC
    monitoring
    Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Next update by 3:00PM CEST, or sooner if anything changes.
15. Oct 22, 2026, 13:00 UTC
    monitoring
    Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Next update by 6:00PM CEST, or sooner if anything changes.
16. Oct 22, 2026, 17:00 UTC
    monitoring
    Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads that render in the page remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Attachments of files pdf, zip, txt is again possible. Next update by 10:00PM CEST, or sooner if anything changes.
17. Oct 22, 2026, 20:02 UTC
    monitoring
    Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads that render in the page remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Attachments of files pdf, zip, txt is again possible. Next update by 10:00AM CEST, or sooner if anything changes.
18. Oct 23, 2026, 09:00 UTC
    monitoring
    Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. Image file uploads that render in the page remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. We will have an update on restoring image file uploads by end of day. Attachments of files pdf, zip, txt is again possible. Next update by 6:00PM CEST, or sooner if anything changes.
19. Oct 23, 2026, 19:44 UTC
    monitoring
    Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. Image file uploads that render in the page remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. We have started reworking the concerned services to ensure we can restore image uploads as fast as possible. We will have a firm ETA by 25 Sunday 12pm CET Attachments of files pdf, zip, txt is again possible. Next update by 12:00PM CEST, or sooner if anything changes.
20. Oct 26, 2026, 04:39 UTC
    monitoring
    Uploads restored: Uploads are available again in all Gainsight Customer Communities. No action is needed. We will continue to monitor closely.

Updates as published by CC (original).