Current Status
| Item | Status |
|---|---|
| Inventory of affected systems | ✅ Done (morning, Oct 22) |
| Emergency mitigation | ✅ Done (noon, Oct 22, no service interruption) |
| Customer notification | ✅ Done (afternoon, Oct 22, in Chinese and Thai) |
| Update to the official patched release | 🔄 Scheduled, in progress system by system |
| Post-patch verification and monitoring | ⏳ System by system after patching |
Initial checks found no anomalies, and we continue to monitor. This notice will be updated as work progresses rather than replaced by a new post.
What Happened
On October 21, 2026, the PHP project disclosed two critical security vulnerabilities (together known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619) with a CVSS v4 score of 9.2 out of 10. An unauthenticated remote attacker may be able to exploit them. Patched releases were published the same day.
PHP is a programming language used by many websites and business systems. According to W3Techs, 69.3% of websites whose server-side language is known use PHP.
The officially recommended emergency settings only reduce exposure; updating to the official patched release is the only complete fix. That is why we are completing the official update on every system after the emergency mitigation.
What We Did
| When | Action |
|---|---|
| Oct 21 | PHP discloses the vulnerabilities and publishes patched releases |
| Oct 22, morning | Inventory of PHP systems used by us and our customers; initial checks found no anomalies |
| Oct 22, noon | Officially recommended emergency mitigation applied, with no service interruption |
| Oct 22, afternoon | Customers notified in Chinese and Thai, with explainer videos |
| Next | Update to the official patched release system by system, then verify each one and keep monitoring |
Explainer Videos for Customers
Questions?
If you have any questions or notice anything unusual in your system, please contact us via our LINE Official Account or email tongyundigital@gmail.com.
Learn More: Security Series on GUANLIZHE.AI
We turned this incident into a series for business owners and managers on GUANLIZHE.AI, no technical background needed (available in Traditional Chinese, Simplified Chinese and Thai):
- Lesson 1 | A critical flaw in PHP, used by 7 in 10 websites: in the AI era, speed of response decides
- Lesson 2 | A security response check-up for owners: five questions that show whether your company can keep up
Update Log
- 2026-10-22: Notice published. Emergency mitigation complete; official patching scheduled.