We are aware of the PHP CVE and have rolled out a possible mitigation for one of the CVEs. We are waiting until the patches are released to start upgrading.
Most communication happened directly through Slack, we're closing it here - since all is patched.
Most systems are back operational. We're still working through less important systems.
To limit the risk until the PHP patches are deployed, we are taking PHP-based services offline as a precaution. This follows the advice of CERT-EU, the cybersecurity service of the EU institutions: where patching isn't possible straight away, organisations should consider taking internet-facing PHP applications off public networks until the fix is applied. https://cert.europa.eu/publications/security-advisories/2026-018/
- Webbear has been taken offline.
- At 13:00 (GMT+2) we will take CAP and our other public Cloudbear tools that are written in PHP offline. Running applications are not affected, but deployments and pipeline generation will fail during this time.
- At 13:00 (GMT+2) we will also stop the web servers on the Webbear hosting platform. This takes Serverbear WHMCS and the other websites hosted there offline.
We will bring these services back online once the PHP patches are released and deployed. We'll post an update here when that happens.
