Ongoing communication about this issue will be covered under the incident "Worldwide PHP Security Event: How TapClicks Is Protecting You"
Posted Oct 21, 2026 - 14:03 UTC
Update
We are continuing to improve the infrastructure to mitigate the global security vulnerability.
Posted Oct 21, 2026 - 13:15 UTC
Update
Our engineering teams remain on active standby as we prepare for the official upstream PHP security release, scheduled for 10:00 AM Eastern (14:00 UTC) today.
Upon release, we anticipate a deployment, verification, and testing window of approximately two hours before bringing core application services back online. To ensure environment stability, platform access and data processing queues will be restored gradually as service checks complete.
We appreciate your patience and will provide our next status update around 10:30 AM Eastern, as new information becomes available.
Posted Oct 21, 2026 - 12:01 UTC
Update
Our teams are working around the clock to prepare for the release of the official PHP security patch and monitor any developments. We will provide more updates as they become available.
Posted Oct 21, 2026 - 08:33 UTC
Identified
On October 20, the PHP security team issued advance notice of two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10 for severity (Remote Code Execution). Upstream maintainers have scheduled an emergency security release for today, October 21, at 14:00 UTC / 10:00 AM EDT.
Given the severity of these vulnerabilities and public discussions surrounding leaked exploit details prior to the official patch release, we made the deliberate decision to take the TapClicks platform temporarily offline until the vendor fix can be applied. This proactive isolation is consistent with guidance from leading cybersecurity advisories, including CERT-EU Advisory 2026-018.
What's Affected: The core TapClicks application is currently unavailable. Data processing queues and daily data loads will automatically resume processing sequentially once platform service is restored.
Next Steps: We will deploy the security patch as soon as possible upon release by the PHP security team, complete environment integrity checks, and restore full service. We will post our next update by 7:30 AM Eastern, or sooner as new information becomes available.
We apologize for the disruption to your workday and appreciate your understanding as we prioritize platform security. For urgent inquiries, please contact our support team at support@tapclicks.com.
Posted Oct 21, 2026 - 05:35 UTC
This incident affected: TapAnalytics/TapReports and TapOrders/TapWorkflow.