No impact incident

Mews: Critical 0 day PHP vulnerability

Current status of Mews: Operational — live Mews status

Timeline

1. Oct 21, 2026, 12:34 UTC
   investigating
   Dear customer, We are aware of reports of a newly disclosed critical (zero-day) vulnerability affecting PHP 5.4+. We want you to know that we’re aware of it and our Security team is actively monitoring the situation. What we’re doing We’re assessing our environment to understand any potential exposure across our systems. We’ve deployed extra monitoring and detection tools to spot and respond to any activity linked to this vulnerability. We’re following guidance from the PHP maintainers and security researchers closely, and we’ll apply mitigations and patches as soon as they’re available and validated. What this means for you At this time, you don’t need to take any action. Protecting your data and keeping our services available are our top priorities, and we’ll contact you directly if anything changes or if you need to do something. We’ll share further updates as the situation develops. If you have any questions, please contact our support team. Thank you for your continued trust.
2. Oct 21, 2026, 14:02 UTC
   investigating
   We're continuing to respond to the recently disclosed critical vulnerabilities in PHP. The PHP maintainers have now released security fixes, and our teams are reviewing them and preparing to roll them out safely. We have also added protective measures to reduce exposure while this work is under way, and we're watching our systems closely. So far we have found no evidence that customer data or Mews services have been affected. What this means for you: You don't need to do anything at this time. If that changes, we'll contact you directly. We'll post another update as our work progresses or if anything changes. If you have questions, please contact our support team.
3. Oct 21, 2026, 15:14 UTC
   investigating
   Updated security packages for the recent PHP vulnerabilities are starting to become available. We're preparing to apply them to the affected parts of our environment once they've been tested. Our protective measures stay in place and we're monitoring our systems closely. So far we've found no evidence that customer data or Mews services have been affected. You don't need to do anything at this time. We'll post another update when remediation is under way.
4. Oct 21, 2026, 22:33 UTC
   resolved
   In response to the Critical PHP Vulnerability announced today, all potentially impacted instances were patched. We continue to monitor the situation diligently. No customer impact was observed. Thank you for your understanding.

Updates as published by Mews (original).