Security maintenance on 21 October: urgent PHP update

Felix Scholz

Published Oct 21, 2026 · 2 min read

Security maintenance on 21 October: urgent PHP update

The PHP project is releasing fixes for two critical vulnerabilities on 21 October 2026. As a precaution, we are taking the fynk app offline briefly from 16:00 CEST to install the update. No data is at risk. This post explains what is happening and is updated as the work progresses.

The PHP project has announced a security release for two critical vulnerabilities. The fynk app runs on PHP, so we are installing the update as soon as it is published, in an unscheduled maintenance window on Wednesday, 21 October 2026, from 16:00 CEST. As a precaution, we are taking the app offline until the update is installed. No data is at risk.

The short version

When: Wednesday, 21 October 2026, from 16:00 CEST (14:00 UTC)
What: an urgent PHP security update on the servers that run the fynk app
Impact: the fynk app is offline for a short time, until the update is installed
Your data: not at risk. Taking the app offline is a precaution.
What you need to do: nothing. Please save open changes before 16:00 CEST.

Updates

We add to this list as the maintenance progresses. All times are CEST.

21 October: Maintenance announced. The PHP security release is scheduled for 16:00 CEST.
21 October, 16:21: The security update is installed and the fynk app is back online. No data was at risk.

What happened

On 20 October 2026, the PHP security team gave advance notice of a security release for two vulnerabilities, both rated critical (CVSS v4.0 score 9.2). The release is scheduled for 21 October 2026 at 14:00 UTC. The PHP team will publish the affected versions, the fixed versions and the technical details with the release, not before.

CERT-EU, the cybersecurity service for the EU institutions, covers the same release in its security advisory 2026-018 and recommends patching as soon as fixed versions are available.

Why we are not waiting for a regular maintenance window

We normally plan maintenance well in advance and keep it outside business hours. A critical vulnerability in the language the app runs on is a reason to make an exception: the safest moment to install the fix is as soon as it exists. So we are applying it on the day of the release instead of waiting for the next scheduled window, and we are keeping the app offline until it is installed. That is a precaution: no data is at risk.

What this means for you

The fynk app is offline for a short time while we update the servers. Please save any open changes before 16:00 CEST.
Requests to the fynk API fail while the app is offline. If an integration reports an error in this window, retry it once the maintenance is over.
Your data is not at risk. Taking the app offline is a precaution.
You do not need to do anything on your side. fynk is a hosted service, so the update happens entirely on our servers.

Questions

If something does not work as expected after the maintenance, or you have questions about it, write to [email protected].

Please keep in mind that none of the content on our blog should be considered legal advice. We understand the complexities and nuances of legal matters, and as much as we strive to ensure our information is accurate and useful, it cannot replace the personalized advice of a qualified legal professional.

Table of contents