Follow-up: additional PHP advisory (session configuration)

23 Oct 2026

Update - We are following up on the PHP security updates communicated earlier this week.

On 23 October, PHP published an additional advisory (CVE-2026-115560) about a specific session configuration. Our architect has checked the WriteBackExtreme and MailScheduler product code and confirmed that it does not use the combination of settings and application behaviour required for this newly described issue.

The action from our earlier messages still applies: if you have not yet installed the applicable product security update, please do so. If your installation uses PHP managed separately by your organisation, ask your administrator to confirm that this PHP runtime has received the security fixes published on 21 October. Updating PHP elsewhere on the server does not update a PHP runtime bundled with the product.

PHP2Shell vulnerability: services taken offline as a precaution

21 Oct 2026

Resolved - All products and services are patched and fully operational. Trulyp 1.1.1 is available through the Customer Portal. Security scans showed no signs of abuse. Read our summary of the incident.23:03 CEST

Monitoring - The Customer Portal and our websites are back online after our server vendor confirmed the PHP patch. All patched product versions can be downloaded from the Customer Portal.22:23 CEST

Update - All WriteBackExtreme and MailScheduler SaaS environments are upgraded and running again.21:36 CEST

Update - More WriteBackExtreme and MailScheduler SaaS environments are back online. For the Customer Portal, we are waiting for our server vendor to patch PHP.19:46 CEST

Update - Trulyp 1.1.1 is built and will be released once the Customer Portal is back online.18:21 CEST

Update - WriteBackExtreme 5.7.7 is available on request through our support team.17:50 CEST

Update - MailScheduler 5.1.4 is available. Docker users can upgrade right away; other installations can request it through our support team.17:38 CEST

Update - We are upgrading and checking each WriteBackExtreme SaaS environment one by one.17:30 CEST

Update - WriteBackExtreme 6.3.1 is available. Docker users can upgrade right away; other installations can request it through our support team.17:26 CEST

Update - We are applying the fix across all products and core services. Builds are slower than usual due to high global demand on GitHub's build infrastructure.16:30 CEST

Identified - We verified that the patch resolves the vulnerability and started rolling it out.15:50 CEST

Identified - PHP released a patch for the vulnerability.15:45 CEST

Investigating - As a precaution against the PHP2Shell vulnerability, we have taken our services offline.