No impact incident

SharpStream: CVE-2026-109618 & CVE-2026-109619 | Critical Security Alert – PHP

Affected: Portal user access, TimbreCMS user access, Radar User Access

Current status of SharpStream: Operational — live SharpStream status

Timeline

1. Oct 21, 2026, 13:24 UTC
   investigating
   We are aware of the recently disclosed security vulnerabilities CVE-2026-109618 and CVE-2026-109619 and are actively reviewing the available information to assess any potential impact on our systems and services. The situation remains fluid, with further technical details and security patches expected from the relevant maintainers. In the meantime, our engineering teams are closely monitoring developments and preparing to deploy the necessary updates as soon as verified patches become available. We will provide a further update once additional information is confirmed, including any relevant remediation actions. We take the security and integrity of our services seriously and will continue to monitor the situation closely.
2. Oct 21, 2026, 16:36 UTC
   identified
   Following our earlier communication regarding security vulnerabilities CVE-2026-109618 and CVE-2026-109619, we wanted to provide a further update on our remediation efforts. Security patches have now been released, and our engineering teams are actively deploying the necessary updates across relevant systems as a precautionary measure. During this process, there may be minor, temporary interruptions to service as systems are updated and restarted. We are taking steps to minimise any disruption and will continue to monitor our services closely throughout the deployment. We appreciate your patience and understanding as we work to ensure our systems remain secure and up to date. We will provide further updates as necessary. Kind regards, The SharpStream Team
3. Oct 21, 2026, 19:03 UTC
   identified
   We would like to provide a further update on our ongoing remediation efforts relating to CVE-2026-109618 and CVE-2026-109619. Our engineering teams have now completed the priority security updates across all identified publicly accessible services. As further technical information regarding these vulnerabilities becomes available, additional assessment and remediation may be necessary. Our engineering teams will continue to monitor developments closely and take any further action required. We have made significant progress today and will continue to prioritise the security and integrity of our services. Further updates will be provided as appropriate.
4. Oct 22, 2026, 14:41 UTC
   identified
   As part of the response to yesterday’s PHP vulnerabilitys and emergency patches, we have updated the scheduling and recording service used by Timbre. As part of this release the recording container has been restarted, which will result in some short / truncated recordings during the deployment window. We will use our recovery tooling to restore affected recordings from backup once broadcasts have reached their scheduled end. Recovery will be run periodically until all impacted recordings have been patched. We shall monitor new recordings from 16:00 BST onwards Risk: We’ve conducted through testing in the dev environment has been positive, but there remains some operational risk given the nature of the security change and the time constraints. Initial signs indicate functionality will continue as expected at the next key recording window (16:00)
5. Oct 22, 2026, 15:36 UTC
   identified
   Recordings commencing at 16:00 BST have successfully started, We are working to recover any incomplete assets from the previous scheduler deployment.
6. Oct 22, 2026, 17:17 UTC
   identified
   Recoverable Incomplete AOD assets from the previous work have now been restored. Concluding this portion of the patch process.
7. Oct 23, 2026, 15:44 UTC
   resolved
   Dear Customers, We can confirm all core SharpStream services are now update to stable versions of PHP with the CVE-2026-109618 and CVE-2026-109619 vulnerabilities patched, resolving this incident. As with any incident of this nature we may expect further patches to be released over the coming weeks. We shall continue to follow guidance on the latest PHP versions and regularly monitor all services to ensure security and stability is retained. Kind regards, SharpStream Team

Updates as published by SharpStream (original).