Critical incident

TimeEdit: Engagement third party security concern

Affected: Engagement

Current status of TimeEdit: Operational — live TimeEdit status

Timeline

1. Oct 21, 2026, 12:36 UTC
   identified
   Due to a security concern affecting PHP, a third-party component used by our Engagement (Presto) products, we have temporarily taken these services, including Attendance and Flow, offline while we are waiting for more information. No other products are affected. We are working to resolve this as fast as possible. Thank you for your understanding and your patience
2. Oct 21, 2026, 13:30 UTC
   identified
   This also affects the SPSS export component of our Evaluation product so we have taken that export off line as well
3. Oct 21, 2026, 19:25 UTC
   identified
   Evaluation SPSS export is back online. As a precaution, we temporarily took the SPSS export in Evaluation offline on October 21 while we applied a security update for a recently disclosed vulnerability in PHP, a third-party software component. The affected component was not directly reachable from the internet; it is only used internally by TimeEdit Evaluation. All other Evaluation functionality, including the other export formats, was not affected. The update along with extra security measures has been applied and rolled out. The SPSS export is now available again. There are no signs that the vulnerability was exploited. No action is needed. We continue to work to bring the Engagement (Presto) products online.
4. Oct 21, 2026, 20:51 UTC
   identified
   Following the critical PHP security update addressing CVE-2026-109618 and CVE-2026-109619, we have successfully updated the PHP installations across all Engage products. Tomorrow morning, we will restore access, after which users will be able to access the systems again.
5. Oct 22, 2026, 06:24 UTC
   identified
   Following the critical PHP security update addressing CVE-2026-109618 and CVE-2026-109619, we have successfully updated the PHP installations across all Engage products. Access has now been restored, and users are able to access the systems again.
6. Oct 22, 2026, 06:24 UTC
   resolved
   This incident has been resolved.

Updates as published by TimeEdit (original).