The yesterday announced PHP vulnerability CVE-2026-109618 and CVE-2026-109619, which affected part of our systems, was monitored throughout the day. As details about the vulnerability were not publicly available until late in the day, we inspected traffic for suspicious activities.

At approximately 18:00 CEST yesterday, 21st of October, the fixed PHP version images were released, and by 18:10 all our systems were patched.

Our investigations have concluded that no fraudulent activity took place on our platform, and have contracted an external security service to verify our findings, as well as work with us to monitor the development of this worldwide issue.