Post-mortem: PHP2Shell vulnerability and AlisQI service interruption
Summary
On October 21, 2026, we took all AlisQI environments offline for about 8 hours as a precaution against two critical vulnerabilities in PHP, the programming language AlisQI runs on. We have found no evidence that any customer data was accessed, changed or deleted.
All times below are Amsterdam time (CEST).
What happened in the PHP world
Two critical flaws in PHP itself, nicknamed "PHP2Shell", leaked to the public before a fix was ready. That left millions of PHP websites worldwide exposed for about a day with no complete protection available.
The bugs. Security researchers (credited by the PHP project: Calif, OpenAI and Wiz, among others) found two flaws in the core of PHP, registered as CVE-2026-109618 and CVE-2026-109619. Both let an attacker run their own code on a server with a single web request, no login needed. Both are rated 9.2 out of 10 for severity and affect every supported PHP version.The plan. The researchers reported the bugs privately, so the PHP project could prepare fixes for release on October 22.
The leak. On October 20, the vulnerability IDs and early details started spreading on Hacker News and social media. Amazon later reported it had already seen an exploitation attempt against its decoy servers on October 17. The PHP project moved its release forward to October 21. That same day, CERT-EU (the EU's cybersecurity team) published an advisory.
The fix. PHP released patched versions on the afternoon of October 21. The PHP project stated that updating was the only complete fix; configuration changes could reduce the risk but not remove it.
Because the flaw sits in PHP itself, it can't be fixed in application code. Only the PHP project could write the fix, and only our hosting provider, Upsun, could install it on the servers that run AlisQI.
Our timeline
We went from first decision to all production environments blocked in 30 minutes, and were fully back online about 8 hours later, once the patched PHP was running on every AlisQI server.
We spent the morning of October 21 assessing the risk, looking for workarounds and coordinating with Upsun.
Why we took AlisQI offline
Our hosting provider, Upsun, implemented temporary security mitigations while the official PHP patches were being prepared. However, based on the information available at the time, these measures could reduce exposure but could not guarantee complete protection against the vulnerabilities.
Given the potential impact on customer data, we decided to temporarily restrict access to AlisQI until the official security patches had been applied and verified.
The risk was an outsider running code on the servers that hold your quality data, with the ability to read, change or delete it. Against that risk, we considered several hours of downtime to be the safer option. We therefore blocked public access to every AlisQI environment (production, sandbox and test), and stopped our internal PHP services.
Waiting for the fix
We brought each environment back only after confirming it was running the patched PHP version, PHP 8.5.12 for almost all of them.
Restoring service depended on two external steps:
- PHP releases the fix. This happened at 15:35 on October 21.
- Upsun installs it. Upsun had to build, test and roll out new server images for each PHP version. Patched images arrived between 18:41 and 20:02.
As soon as a patched image reached one of our environments, our team checked the running PHP version, lifted the block, and tested that customer pages loaded. The first environment was back at 19:45 and the last at 21:32.
Rationale for our decision
Our precautionary decision was consistent with the approach recommended by cybersecurity authorities, and with measures taken by other organizations across Europe.
- Official advice. CERT-EU advised patching immediately and, where that wasn't possible, isolating internet-facing applications until the fix was applied and verified. The UK NCSC and the US NSA gave similar advice to take systems offline if they couldn't be updated. On October 21, no patch could be applied yet.
- What others did. The Dutch National Cyber Security Centre took its own website offline as a precaution, as did the Dutch House of Representatives. Government services in Finland, Denmark, France, Germany and Belgium, several Dutch hospitals and the Port of Rotterdam did the same.
- No complete alternative. The PHP project stated that updating was the only safe option, as no complete mitigation existed.
Forensic investigation
On October 22, our development team reviewed server logs, application logs and file changes. We covered the period from before the leak became public up to the moment each environment was patched.
Our investigation found no evidence of unauthorized access to customer data, and we identified no loss of customer data. The incident response has been concluded, and several internal preventive actions have been scheduled as part of our ongoing improvement processes.
Sources
About
AlisQI is the easiest QMS for process and batch manufacturers to stay in control. Built on a data-first architecture, AlisQI brings quality, laboratory, and production data together in one central platform, enabling structured workflows, real-time insights, and practical AI. Instead of traditional modules, AlisQI delivers focused Solvers that address specific quality challenges across Quality Control, Document Management, Continuous Improvement, Supplier Quality, and EHS. Manufacturers can be up and running within weeks - without the lengthy, complex implementations that have traditionally characterized enterprise QMS. Staying in control shouldn't be complicated.
AlisQI Corporate Disclaimer:
See https://www.alisqi.com/en/disclaimer