Hi all,

You may have heard of the recent announcements of CVE-2026-109618 and CVE-2026-109619. Some say it's been exploited in the wild and that the mitigations are ineffective. Patches are schedules to be released later today.

I suppose Invision team is handling that for cloud customers. Can we have an update once the patch is applied? Also, are you aware of exploitation attempts on Invision? Would it be affected (I know this is a hard question when no one seem to have details though)?

Thanks!

References

• https://www.php.net/archive/2026.php#2026-10-20-1

• https://cert.europa.eu/publications/security-advisories/2026-018/

• https://en.wikipedia.org/wiki/PHP2Shell

Edited October 21Oct 21 by Fernando Mercês

We are actively working with our SecOps team on both immediate and long term mitigation strategies. For security purposes, we are unable to share specific information pertaining to our infrastructure, but rest assured, we take security seriously and are working diligently with what little information is yet available. However needless to say, as a cloud customer, this is something that we deal with so that you don't have to. 🙂

A huge benefit of Cloudflare is the company's ability to also attempt to mitigate this.

"Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers."

Cloudflare Blog

Cloudflare deploys protections against php2shell vulnerab...

Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit

Just now, Ryan Ashbrook said:

No, you do not need to do anything.

Okay, thank you. I am still scared by this series of tubes! I was looking to finally upgrade to Invision Community 5 and then all this happened and I started panicking.

3 hours ago, Marc said:

For security purposes, we are unable to share specific information pertaining to our infrastructure, but rest assured, we take security seriously and are working diligently with what little information is yet available.

I understand. Thanks for your quick answer.

2 hours ago, SteelEagle said:

I was looking to finally upgrade to Invision Community 5 and then all this happened and I started panicking.

I am sorry my post might have contributed to this feeling of yours. It was not my intent to promote any FUD. This has probably nothing to do with Invision Community software as the vulnerability is in PHP itself. I posted it here because they handle the cloud instances, so they are the ones in control of what PHP version runs there. :)

The folks running self-hosted instances, on the other hand, probably want to upgrade their PHP software asap (patched versions are already available), but again, this has nothing to do with Invision team. 🙏

Edited October 21Oct 21 by Fernando Mercês

We were having some difficulties with access and posting this morning. What's the status of the update?

15 hours ago, Fernando Mercês said:

I understand. Thanks for your quick answer.

I am sorry my post might have contributed to this feeling of yours. It was not my intent to promote any FUD. This has probably nothing to do with Invision Community software as the vulnerability is in PHP itself. I posted it here because they handle the cloud instances, so they are the ones in control of what PHP version runs there. :)

The folks running self-hosted instances, on the other hand, probably want to upgrade their PHP software asap (patched versions are already available), but again, this has nothing to do with Invision team. 🙏

Haha no you didn't contribute to my worry! I was fretting about it anyway. Despite growing up with the internet I still don't understand 99% of it so I wasn't sure. 99% of the answers I found would be like "Oh sure you're fine :) Unless you're not". It would be mostly calming me and then it would say something about older PHP and I don't know what version of anything my forum is on. I reckoned that it would be on the latest that 4.7.25 is on since I think it all just gets upgraded together on Cloud unless you do something strange, and I don't know enough to even attempt something strange. So I reckoned I was safe but didn't really know how to ask! So if anything, this topic was helpful. Thank you too!

I would just like to say thank you to all those in the Invision Team.

Reading the world wide response to the critical flaws we could have been in a far worse position if it wasn't for the IInvision Team working over time!

13 hours ago, ch0wnuk said:

I would just like to say thank you to all those in the Invision Team.

Reading the world wide response to the critical flaws we could have been in a far worse position if it wasn't for the IInvision Team working over time!

I would like to echo the above sentiment

As someone who was landed with the taking over of a very busy forum, the team at Invision have been invaluable to me on many occasions, but right now knowing we are in safe hands is very good to know.

Yes - thanks to the team for keeping the site up.

I shudder to think of the cost and hassle with our previous arrangement.