This update provides information on the immediate and effective action taken by Red61 to mitigate the effect of reported PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
As you may be aware, a significant industry-wide security issue involving critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) was announced on 21 October 2026.
In response to the security guidance issued by the relevant authorities, we took proactive precautionary measures to protect our infrastructure.
This included temporarily taking our PHP-based services, including our WordPress ticketing sales websites and payment pages, offline while we assessed potential exposure.
This was a precautionary measure and was not prompted by any identified security breach.
We completed our internal investigation and remediation activities promptly, and all affected services have been safely restored.
Read on to understand more about the proactive steps taken by the Red61 team to resolve this issue.
Issue Resolution and Service Restoration
The following actions were taken:
- Initial containment: We proactively isolated and temporarily took our PHP-based WordPress ticketing sales websites and payment pages offline to mitigate potential risk.
- Investigation: We conducted a security review and audit of the affected environments. No evidence of unauthorised access, data exfiltration or system compromise was identified.
- Remediation and validation: We applied the necessary security patches and carried out vulnerability scanning and retesting to validate the remediation.
- Service restoration: Following these checks, all affected services were verified and safely returned to normal production operation.
Service Downtime
The total downtime required for the affected services during resolution and restoration was recorded as follows:
- WordPress Ticketing Microsite: 90 minutes, from 16:51 UTC.
- Phone Sales Payment Service: 120 minutes, from 16:51 UTC.
Further Steps
While this issue has been resolved within our environment, PHP is widely used across websites and web applications. We therefore recommend reviewing your own systems and applications to determine whether any action is required.
For further information in your region, please refer to the updates provided by the UK National Cyber Security Centre (NCSC) and Australian Cyber Security Centre.