OutageDB

No impact incident

Staffbase: [All Systems] [Security Advisory] – Critical PHP vulnerabilities — no customer-facing service impact

Oct 21, 2026, 14:52 UTC
started
07:00 UTC
resolved
—
duration

Current status of Staffbase: Operational — live Staffbase status

Timeline

  1. Oct 21, 2026, 07:00 UTC
    resolved
    We are aware of the critical PHP vulnerabilities recently published (CVE-2026-109618 and CVE-2026-109619) and have been monitoring the situation closely. Emergency web application firewall rules addressing these vulnerabilities were deployed by Cloudflare on 21-Oct-2026 and are active across our infrastructure. The core Staffbase platform does not use the affected components. A small number of plugins did; these were moved to hardened base images on 21-Oct-2026, and the patched PHP versions have been rolled out to all affected components as of 22-Oct-2026. We have seen no indication of exploitation in our environment. All systems have been operating normally throughout, and no further action is required. If you have any questions regarding this topic, please reach out to our support team at [[email protected]](mailto:[email protected]).

Updates as published by Staffbase.

Other services with incidents at the same time

This was part of a wider event: 12 services reported incidents within the hour.

More Staffbase incidents