Hi all,

You may have heard of the recent announcements of CVE-2026-109618 and CVE-2026-109619. Some say it's been exploited in the wild and that the mitigations are ineffective. Patches are schedules to be released later today.

I suppose Invision team is handling that for cloud customers. Can we have an update once the patch is applied? Also, are you aware of exploitation attempts on Invision? Would it be affected (I know this is a hard question when no one seem to have details though)?

Thanks!

References

• https://www.php.net/archive/2026.php#2026-10-20-1

• https://cert.europa.eu/publications/security-advisories/2026-018/

• https://en.wikipedia.org/wiki/PHP2Shell

Edited October 21Oct 21 by Fernando Mercês

We are actively working with our SecOps team on both immediate and long term mitigation strategies. For security purposes, we are unable to share specific information pertaining to our infrastructure, but rest assured, we take security seriously and are working diligently with what little information is yet available. However needless to say, as a cloud customer, this is something that we deal with so that you don't have to. 🙂

A huge benefit of Cloudflare is the company's ability to also attempt to mitigate this.

"Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers."

Cloudflare Blog

Cloudflare deploys protections against php2shell vulnerab...

Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit

So to clarify, I am tech illiterate. I usually just push the upgrade button for my forum when it comes up. So I assume that means I'm on Cloud, haha. Do I need to do anything?

4 minutes ago, SteelEagle said:

So to clarify, I am tech illiterate. I usually just push the upgrade button for my forum when it comes up. So I assume that means I'm on Cloud, haha. Do I need to do anything?

No, you do not need to do anything.

Just now, Ryan Ashbrook said:

No, you do not need to do anything.

Okay, thank you. I am still scared by this series of tubes! I was looking to finally upgrade to Invision Community 5 and then all this happened and I started panicking.

2 minutes ago, SteelEagle said:

Okay, thank you. I am still scared by this series of tubes! I was looking to finally upgrade to Invision Community 5 and then all this happened and I started panicking.

This is a reason to upgrade in my opinion :~)

Just now, Chris027 said:

This is a reason to upgrade in my opinion :~)

Haha yeah. I will probably be doing so when I can get the other members of my community on to give'm the news. I run (checks) Version 4.7.25 currently and will be heading to the latest in 5 when I can, but at least I don't have to worry about this scary PHP stuff. Thank you Invision for your heavy work on this matter!

3 hours ago, Marc said:

For security purposes, we are unable to share specific information pertaining to our infrastructure, but rest assured, we take security seriously and are working diligently with what little information is yet available.

I understand. Thanks for your quick answer.

2 hours ago, SteelEagle said:

I was looking to finally upgrade to Invision Community 5 and then all this happened and I started panicking.

I am sorry my post might have contributed to this feeling of yours. It was not my intent to promote any FUD. This has probably nothing to do with Invision Community software as the vulnerability is in PHP itself. I posted it here because they handle the cloud instances, so they are the ones in control of what PHP version runs there. :)

The folks running self-hosted instances, on the other hand, probably want to upgrade their PHP software asap (patched versions are already available), but again, this has nothing to do with Invision team. 🙏

Edited October 21Oct 21 by Fernando Mercês

We were having some difficulties with access and posting this morning. What's the status of the update?

10 hours ago, Dave Ambrose said:

We were having some difficulties with access and posting this morning. What's the status of the update?

Take a look here

Things should be working now, but please let us know if you have any further issues

Just to confirm those with community in the cloud Version 4.7.25 have been protected?

Unable to check full PHP Version with command line

1 minute ago, ch0wnuk said:

Just to confirm those with community in the cloud Version 4.7.25 have been protected?

Unable to check full PHP Version with command line

Please see the link just above your post there

15 hours ago, Fernando Mercês said:

I understand. Thanks for your quick answer.

I am sorry my post might have contributed to this feeling of yours. It was not my intent to promote any FUD. This has probably nothing to do with Invision Community software as the vulnerability is in PHP itself. I posted it here because they handle the cloud instances, so they are the ones in control of what PHP version runs there. :)

The folks running self-hosted instances, on the other hand, probably want to upgrade their PHP software asap (patched versions are already available), but again, this has nothing to do with Invision team. 🙏

Haha no you didn't contribute to my worry! I was fretting about it anyway. Despite growing up with the internet I still don't understand 99% of it so I wasn't sure. 99% of the answers I found would be like "Oh sure you're fine :) Unless you're not". It would be mostly calming me and then it would say something about older PHP and I don't know what version of anything my forum is on. I reckoned that it would be on the latest that 4.7.25 is on since I think it all just gets upgraded together on Cloud unless you do something strange, and I don't know enough to even attempt something strange. So I reckoned I was safe but didn't really know how to ask! So if anything, this topic was helpful. Thank you too!

Someone with next to zero tech knowledge here

There is mention above about being on the "cloud", how would I check to see if my forum is?

If it isn't what is the advantage or not of being on the cloud?

We're on version 5.0.20

1 minute ago, Phantom_OTIB said:

Someone with next to zero tech knowledge here

There is mention above about being on the "cloud", how would I check to see if my forum is?

If it isn't what is the advantage or not of being on the cloud?

We're on version 5.0.20

You're on Cloud. Cloud is our Software-as-a-Service offering, meaning you have our software, infrastructure, and support on both. You only have to manage your community, you don't have to worry about the software or infrastructure. That's on us.

The alternative is self-hosting where you just buy the software from us and you go and find your own infrastructure to host the software on and are responsible for that infraustructure. You only have software support from us.

I would just like to say thank you to all those in the Invision Team.

Reading the world wide response to the critical flaws we could have been in a far worse position if it wasn't for the IInvision Team working over time!

2 hours ago, ch0wnuk said:

I would just like to say thank you to all those in the Invision Team.

Reading the world wide response to the critical flaws we could have been in a far worse position if it wasn't for the IInvision Team working over time!

I shall pass on to the team. Thank you for your kind words.

13 hours ago, ch0wnuk said:

I would just like to say thank you to all those in the Invision Team.

Reading the world wide response to the critical flaws we could have been in a far worse position if it wasn't for the IInvision Team working over time!

I would like to echo the above sentiment

As someone who was landed with the taking over of a very busy forum, the team at Invision have been invaluable to me on many occasions, but right now knowing we are in safe hands is very good to know.

Yes - thanks to the team for keeping the site up.

I shudder to think of the cost and hassle with our previous arrangement.