The official PHP security fix for CVE-2026-109618 and CVE-2026-109619 has been installed on our servers, and MediaLab is back online. We're installing the update on the remaining servers and keeping a close eye on the platform.
Some of the temporary security measures from earlier today are still active while we finish. Some file uploads or forms may not work as expected until then. We'll remove the measures once all servers are updated and checked.
If you have any problems, please contact our support team. Thank you for your patience today.
Posted Oct 21, 2026 - 17:01 CEST
Update
Update: waiting for patched packages
The official PHP fix for CVE-2026-109618 and CVE-2026-109619 has been released. The updated packages for our servers are being published as we speak. As soon as they're available, we will install them on all servers, check that everything works, and bring MediaLab back online.
MediaLab remains offline until then, as a precaution. We'll post the next update here once the update is installed or the timeline changes.
Thank you for your patience.
Posted Oct 21, 2026 - 16:11 CEST
Update
Earlier today we put temporary measures in place for two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). PHP is the software our platform runs on. Details of these vulnerabilities became public before an official fix was available, and the full impact is not yet clear.
Because the impact and severity are still uncertain, we have taken the MediaLab platform offline as a precaution. We think this is the safest option until the official fix is released and installed.
What this means for you - MediaLab is currently not available. This includes the web application, share links, uploads and the API. - Integrations and automated workflows that connect to MediaLab will not work during this time.
What's next The PHP project has announced the official fix for 21 October 2026 at 14:00 UTC (16:00 CEST). We will install and verify it as soon as it is available, then bring the platform back online. We will post an update here as soon as we know more.
We understand this causes serious disruption and we apologise for the inconvenience. We will keep this page updated.
Posted Oct 21, 2026 - 14:09 CEST
Identified
Details of two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) became public before an official fix was available. We use PHP on our servers. The vulnerabilities affect the way PHP processes certain types of requests, mainly those used for file uploads and some web forms.
As a precaution, we have temporarily blocked this type of request on all our servers until the official fix is available and installed. We have no indication that MediaLab has been affected. This is a preventive measure.
What you may notice - Some forms may fail to save, for example editing file metadata or saving certain settings. - Some file uploads may fail. - You may get an error or "access denied" message when you do one of these actions.
Regular use of MediaLab, such as browsing, searching, viewing, sharing and downloading files, is not affected. We have kept the normal upload functionality available and are working to limit the impact as much as possible. Please choose "Accelerated upload" > "Smart Routing" as a work-around if you experience problems uploading files. This is a free alternative available for all users.
What's next The PHP project has announced the official fix for 21 October 2026 at 14:00 UTC (16:00 CEST). We will install it as soon as it is released, then lift this measure and update this page.
If something you need doesn't work in the meantime, please contact our support team. We apologise for the inconvenience and thank you for your patience.
Posted Oct 21, 2026 - 11:25 CEST
This incident affected: Web Interface (Web Interface) and REST API, Media Zone - Hybrid Connections.