Temporary security measure: maintenance mode
Last updatepostmortemOct 22 · 05:58 UTC
Update 22 October 2026: post-incident review
On 20 October 2026, two critical vulnerabilities in PHP were made public (CVE-2026-109618 and CVE-2026-109619, also known as "PHP2Shell"). PHP is widely used web software, and MediaLab's applications run on it. The vulnerabilities could allow an attacker to run code on an affected web server without logging in.
On the morning of 21 October we added extra protection that blocked the attack method in use at that time. In the afternoon we took the platform offline as a precaution while we waited for the official PHP security update to become available, and applied it to all servers. The platform was unavailable from 14:10 to 16:52 CEST and has run normally since.
We have reviewed our web traffic and server logs from 20 October until the update was installed, and we found no evidence that these vulnerabilities were exploited on the MediaLab platform. We are adding further measures, including stricter request limits and better logging, to strengthen our defences against similar issues.
If you have any questions, please contact MediaLab support.
Reported by MediaLab on their status page.
