Update: The PHP security fix has been deployed to production and we are continuing to monitor closely. We have found no evidence that the vulnerability was exploited on our platform.
File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal.
Next update by 08:00AM CEST, or sooner if anything changes.
Posted Oct 21, 2026 - 20:53 CEST
Update
Update: We are completing the testing in staging before deploying to production.
File uploads remain temporarily disabled until the fix is deployed and verified. Our monitoring continues to show no evidence that the vulnerability was exploited on our platform.
Reading, posting and replying continue to work as normal. Our next update will be by 8:30PM CEST, or sooner if anything changes.
Posted Oct 21, 2026 - 19:00 CEST
Update
Update: We are testing the released fix to ensure we don't introduce any regressions.
File uploads remain temporarily disabled until the fix is deployed and verified. Our monitoring continues to show no evidence that the vulnerability was exploited on our platform.
Reading, posting and replying continue to work as normal. Our next update will be by 7PM CEST, or sooner if anything changes.
Posted Oct 21, 2026 - 18:00 CEST
Update
Update: We are testing the released fix to ensure we don't introduce any regressions.
File uploads remain temporarily disabled until the fix is deployed and verified. Our monitoring continues to show no evidence that the vulnerability was exploited on our platform.
Reading, posting and replying continue to work as normal. Our next update will be by 6PM CEST, or sooner if anything changes.
Posted Oct 21, 2026 - 17:30 CEST
Update
Update: The PHP security team has released the fix. We are now validating it and testing it against our platform. We will deploy it across our EMEA and US infrastructure once testing is complete.
File uploads remain temporarily disabled until the fix is deployed and verified. Our monitoring continues to show no evidence that the vulnerability was exploited on our platform.
Reading, posting and replying continue to work as normal. Our next update will be by 5PM CEST, or sooner if anything changes.
Posted Oct 21, 2026 - 16:08 CEST
Update
We are continuing to work on a fix for this issue.
Posted Oct 21, 2026 - 16:07 CEST
Update
PHP vulnerability (PHP2Shell): uploads temporarily disabled Gainsight Customer Communities uses PHP. On October 20, two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell) were disclosed ahead of the official fix. The PHP security team is releasing the fix today, October 21, at 16:00 CEST (14:00 UTC).
What we’ve done:
Disabled all file uploads across all communities, including inline images, profile avatars and post attachments. Put additional firewall protections in place against the type of request used in these attacks. Reviewed our logs for signs of exploitation. So far, we’ve found no evidence the vulnerability was exploited on our platform.
What happens next:
We’ll apply the PHP security update across our EMEA and US infrastructure as soon as it’s released. After patching, we’ll run a full compromise review and share the outcome here. We’ll restore uploads once the patch is applied and verified.
Reading, posting and replying work as normal. Our next update will be by 17:00 CEST, or sooner if anything changes.
Posted Oct 21, 2026 - 15:00 CEST
Update
We are continuing to work on a fix for this issue.
Posted Oct 21, 2026 - 14:59 CEST
Update
We are continuing to monitor the platform closely. Our investigation has found no evidence that the security issue we are addressing was exploited. File uploads remain temporarily disabled as a precaution, and we are working to restore them as soon as possible.
We will keep this page updated as the situation evolves.
Posted Oct 21, 2026 - 14:40 CEST
Update
We are continuing to work on a fix for this issue.
Posted Oct 21, 2026 - 14:34 CEST
Identified
As a precaution, we have temporarily disabled upload functionality on the community. During this time, members will not be able to upload files, including inline images, profile avatars, and post attachments. All other community functionality, including reading, posting, and replying, is unaffected.
We have not seen any impact to customer data or community availability. We expect to restore uploads once our work is complete and will update this page as soon as we have more information.