Critical incident

iSpot: PHP Security Vulnerabilities

Affected: iSpot Analytics, Universal API

Current status of iSpot: Operational — live iSpot status

Timeline

1. Oct 21, 2026, 16:29 UTC
   investigating
   Two critical vulnerabilities in PHP, a widely used technology powering websites and applications, have created an internet-wide security issue affecting organizations and service providers. Our "universal-api" — which powers the ISpot dashboard — relies on PHP and is potentially exposed. As a precaution, we're taking the dashboard offline until a patch is available and applied. We'd rather pause access briefly than leave a known door open. We will share updates with you as they are available and appreciate your patience! For additional background, see CyberScoop’s coverage. https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/
2. Oct 21, 2026, 20:44 UTC
   investigating
   We’ve applied the PHP patches and testing is underway in our lower environments. The dashboard remains offline out of an abundance of caution while we verify the fix, and no action is needed on your part. We will provide the next update in 4 hours, or sooner if a significant status change occurs. Thank you for your patience as we work to protect you and your data.
3. Oct 22, 2026, 00:33 UTC
   investigating
   We are continuing to investigate this issue.
4. Oct 22, 2026, 00:35 UTC
   resolved
   Services have been restored to universal-api and dashboard.

Updates as published by iSpot (original).