The key points first

• You do not need to take any action at this time. If anything changes, we will contact you directly with specific instructions.
• We have reviewed our logs and security monitoring from 17 October until 11:00 CEST on 22 October. We found no evidence that the vulnerabilities were exploited against Heartpace or that customer data was affected.
• The update is still being rolled out, and we expect it to be complete on Friday.

What happened

On 21 October, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. They affect web servers running PHP worldwide and can, under certain conditions, allow an attacker to run code on a server without logging in. Authorities including CERT-SE and the US agency CISA urged all organizations to update immediately.

What we have done

We started work the same day, following the vulnerability management procedures in our information security management system. Heartpace is certified to ISO/IEC 27001:2022. The first updated and tested components were ready that evening, and the rest overnight. Each service is now being rebuilt with the new components, step by step and with no planned downtime.

The log review

Once the last service has been updated, we will run a final check of our logs, covering the period from 11:00 CEST on 22 October until then. We will publish a final update here when it is complete, no later than Friday 23 October at 16:00 CEST.

Frequently asked questions

Has our data been affected?

Our review up to 11:00 CEST on 22 October found no evidence of it. A final check will be made once the last service has been updated. If anything turns out to affect your data, we will inform you directly in line with our data processing agreement.

Why is the infrastructure being rebuilt?

That is how the update is applied: each service gets new components with patched PHP. It is a precaution, and there is no suspected compromise at this time.

Do we need to do anything?

No, not at this time. If the review finds anything that affects your credentials or integrations, we will contact you directly with specific instructions.

Are you assessing this under GDPR?

Yes. Our assessment is that no personal data breach has occurred and that no notification is required. We will review it again after the final check.

Are your websites affected?

Our websites are hosted separately from the Heartpace platform and have all been updated.

Should we inform our employees?

That is your decision. Based on what we know today, your employees do not need to take any action.

Who do we contact?

Your security officer or DPO can reach us at support@heartpace.com. Please include “PHP2Shell” in the subject line so we can prioritize your question.

Updates

• 22 October, 19:00 CEST: the log review up to 11:00 CEST is complete, with no findings. The GDPR assessment has been made. The update will be completed on Friday.
• 22 October 2026, 12:00 CEST: first statement published.

Denys Shersheniuk, CTO, Heartpace