Pulseway Incident History

1. identifiedOct 23 · 20:27 UTC

   Pulseway is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Pulseway has completed an evaluation of its product portfolio regarding these vulnerabilities. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: Pulseway - Fully Patched Software Catalog - Unaffected

Reported by Pulseway on their status page.

1. resolvedOct 7 · 07:59 UTC

   This incident has been resolved.

Reported by Pulseway on their status page.

1. postmortemOct 29 · 16:03 UTC

   Summary:

   Between 2026-10-01 18:24 UTC and 2026-10-01 20:02 UTC, some Pulseway PSA customers were unable to log in to or access the application and received a "Something went wrong, please try again" error message. Engineering identified a database condition affecting application availability and implemented corrective changes to restore normal service.

   Root Cause:

   A database-related issue affected the availability of a service required for Pulseway PSA login and application access. Once the underlying condition was identified, corrective changes were applied and service was restored.

   Incident Timeline:

   • Identified: 2026-10-01 18:24 UTC
   • Public Notification: 2026-10-07 18:10 UTC
   • Resolved: 2026-10-01 20:02 UTC

   Preventative Measures:

   To reduce the likelihood and impact of similar incidents in the future, we are taking the following steps.

   Enhancements to Monitoring and Alerting

   • Improve monitoring of key database and application services to identify potential issues sooner.
   • Expand automated alerting and availability checks to help detect customer-facing impacts more quickly.

   Enhancements to Incident Management and Response

   • Update and validate operational procedures for responding to database-related service disruptions.
   • Review incident escalation processes to ensure the appropriate teams are engaged promptly during service-impacting events.

   Enhancements to Infrastructure and Database Operations

   • Review database recovery, backup, and maintenance practices to ensure they align with operational requirements and long-term reliability goals.
   • Continue validating recovery procedures through routine testing and operational reviews.

Reported by Pulseway on their status page.