Update, 21 October 2026, 15:25 UTC: All ASIMUT systems are back online. Security updates have been installed and verified on every server.

On 21 October, we temporarily suspended access to ASIMUT to protect our clients from two critical security vulnerabilities in PHP, a widely used software component that powers ASIMUT and millions of other web applications.

The vulnerabilities were not in ASIMUT’s own code. Our investigations are ongoing, but so far we have found no indication that any ASIMUT system was compromised or that client data was affected. The timely suspension of services significantly reduced the risk of such a compromise.

The necessary security updates have now been installed and verified across all ASIMUT servers, and normal service has been restored.

What happened

On 20 October, the PHP security team announced an emergency release to address two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each rated 9.2 out of 10 in severity.

Unfortunately, details became public ahead of the planned disclosure, potentially giving attackers an opportunity to exploit the vulnerabilities before security fixes were available. The release was brought forward to 21 October at 14:00 UTC. CERT-EU issued a security advisory, and the UK’s National Cyber Security Centre (NCSC) advised organisations to consider taking affected systems offline until they could be secured.

Why we took ASIMUT offline

We recognise how disruptive an unexpected shutdown can be for our clients. It is not a decision we take lightly.

The situation developed rapidly, with important details emerging gradually from multiple sources. Throughout the day, we closely monitored developments and weighed the potential security risks against the consequences of interrupting service.

Although the precise nature of the vulnerabilities was initially unclear, the available information indicated that attackers might be able to execute code on affected servers without authentication. Until security fixes became available, this risk could not be fully eliminated. Reports of attempted exploitation added to the urgency.

Given these developments, and the recommendations from national and European cybersecurity authorities, we concluded that temporarily suspending access was the most responsible course of action.

The PHP security advisory published alongside the fixes subsequently confirmed the severity of the vulnerabilities and that they did indeed apply to ASIMUT servers, as well as a substantial proportion of other web servers and applications worldwide.

Timeline (UTC)

  • 20 October, evening: Details of the vulnerabilities begin circulating publicly.
  • 21 October, around 11:30: Security researchers begin reporting attempted exploitation.
  • 12:40–12:45: We suspend access to all ASIMUT sites as a precaution.
  • 12:56: We notify all clients by email and publish our initial service notice on the sites, while keeping PHP disabled.
  • 13:52: Security fixes are published by the PHP security team.
  • 14:42: Tested security updates for our server platform become available, and we immediately begin updating servers.
  • 14:54: The first ASIMUT site is restored and verified. Other sites follow in quick succession.
  • 15:25: All ASIMUT sites are back online and confirmed operational.

Restoring service took longer than our initial published estimate of 45 minutes. Security updates for our servers’ operating system became available only some time after PHP’s own release, and the global scale of the incident caused additional delays in obtaining and applying the updates.

We kept each client site offline until the necessary updates had been installed and verified.

Do you need to do anything?

No action is required. There is no need to change passwords or settings, and single sign-on continues to work as before.

If you experience any issues, please contact us at [email protected].

We apologise for the disruption, particularly as it came at short notice during a working day. Our priority throughout was to protect our clients’ systems and data. Given the information available at the time, we believe temporarily suspending access was the right decision.