Incident History

Today at approximately 08:45 CET, a sudden system overload caused increased latency across the Izix platform, affecting normal service operation. Our team began responding at 08:50 CET, and service was restored to normal operation at approximately 09:15 CET.

The platform is currently operating normally. We are investigating the root cause to understand what triggered the overload and to prevent it from happening again. We will share an update once our analysis is complete.

We have identified latencies on our main system and we are investigating the cause in order to resolve operations. Ability to open the gate is impacted. We advice to keep barriers open if possible until we have resolved the situation

Summary

On 21 October 2026, the PHP Security Team published an advisory on two critical vulnerabilities (CVSS 9.2) in the PHP interpreter, affecting PHP installations worldwide. These vulnerabilities could allow unauthenticated remote code execution. All Izix production environments have now been updated to patched PHP versions, fully addressing both vulnerabilities. The incident is now resolved.

Event Timeline

20 October: first public information about the vulnerabilities. Our security and engineering teams started monitoring the situation. 21 October at 4PM: PHP releases patched versions and its official advisory. Izix immediately applied all mitigation measures recommended by the PHP Security Team across production environments, and puts enhanced monitoring in place. 22 October 5PM: all production environments have been updated to patched PHP versions, together with the related system components.

Actions taken

Mitigation measures recommended by the PHP Security Team applied while updates were in progress. Update of all production environments to latest patched PHP versions. Update of the underlying operating systems and related components. Review of systems and logs covering the full exposure period, from 20 October onwards.

Impact

No indication of vulnerability exploitation, system or data compromission was identified. The vulnerabilities have now been resolved.

On 21 October, the PHP Security Team published an advisory on two critical vulnerabilities affecting all PHP installations worldwide (CVE-2026-109618 and CVE-2026-109619).

At this hour, all non essential servers have been shut down, all mitigation measures recommended by the PHP Security Team have been applied and released to our production environments. These measures significantly reduce the risk of exploitation through known attack paths, without fully eliminating it.

No indication of compromise has been identified. Enhanced monitoring is in place.

Our teams are now completing the full update of PHP and all related components to the latest version.

The service remains fully available. No action is required on your side.

Follow this page for updates.