Emergency Security Maintenance (21 October 2026)

On 21 October 2026, Adversus carried out emergency maintenance to address PHP2Shell, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). Public access to the application and its interfaces, including the API, was temporarily suspended while we applied the security updates and validated the platform.

The application was back online around 01:00 on 22 October. A subsequent API issue was resolved at 02:06 (CEST).

Our checks have identified no evidence of exploitation, unauthorised access, disclosure of client data or compromise of data integrity. The impact was limited to service availability during maintenance and recovery.

If you use API integrations or automations: please review jobs scheduled during the maintenance period. Failed requests or jobs that did not run may need to be resubmitted. Check whether an operation completed before resending to avoid duplicates.

The full post-mortem, including timeline and background for our decision, is available here: Full report

Thank you for your understanding. Please contact our support team through the application if you experience any remaining issues.

Jacob Rasmussen, CISO, Adversus A/S

All public facing interfaces are now updated, we have done extensive testing automated and manually to ensure functionalities are working as intended.

There will of course be a focus in the upcoming period on fixing any bugs, that might arise due to these updates, so please reach out through the support chat and report any if found.

We will provide a Post-Mortem of the event, the RCA being known, but in order to provide a more detailed and precise timeline as well the steps that was taken, in order to reach a resolved state.

All the public interfaces are now updated and we are currently doing final testing, before putting the application online again. Our ETA is therefore still 00:00-02:00 CET before having the matter resolved completely.

Next update will be at 01:00 CET

We are still in the process of updating and thoroughly testing all public interfaces before deploying them to production. Given the CVSS score of 9.2 for these vulnerabilities, we are proceeding with extreme care to protect the security of the platform and the data it holds. Our expected go-live window remains unchanged at 00:00–02:00 CET.

Next update will be released before midnight (being 00:00 CET)

We are progressing with our testing, having all the systems checked. We have the app up and running in a restricted environment. Our current ETA is 00.00-02.00.

We will update again in a approx. one hour (being 22.30) - unless relevant information becomes available earlier.

We have the updates implemented and are currently running internal testing to ensure everything is operating as intended. We will send out a notification as soon as the application is back online.

The next update will be no later than 21.30, with an expectation to give a more precise ETA, for when the service are operational again.

Update

Our engineers are carrying out the needed security update, and the work is progressing well. As soon as we have a exact time for Adversus being available we will let you know.

We are sorry for the inconvenience – we’ll keep posting updates here.

Important: Adversus will be offline until tomorrow morning for a security update

We’re taking Adversus offline today shortly, to install the PHP security update and complete our security checks. We expect Adversus to be back online by early tomorrow morning (CEST time), 22 October. Our team is working as fast as they can to ensure as little interruption as possible.

We know this is disruptive, and we’re sorry for the inconvenience. We chose this step because keeping your data secure comes first

We’ll post updates on our status page: https://status.adversus.io/

Important: Possible Adversus downtime at 16:00 CEST (14:00 UTC)

Today, 21 October, the PHP Foundation releases a security update fixing two critical vulnerabilities in PHP. It’s scheduled for 16:00 CEST (14:00 UTC) but may arrive earlier, and PHP advises applying it immediately.

We’re monitoring our systems and will install the update the moment it’s available. If we judge there’s any risk to your data, we may take Adversus offline to protect it. At this point we don’t have an estimation of a potential downtime (if needed). Keeping your data secure is our number one priority.

We’ll keep you posted throughout this on our status page here: https://status.adversus.io/

More details: https://www.php.net/archive/2026.php#2026-10-20-1