PHP vulnerabilities - Global

Incident Report for Tillo

Resolved

This incident has been resolved.

Posted Oct 22, 2026 - 09:10 BST

Investigating

We’re aware of the PHP vulnerabilities publicly disclosed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell). We put additional web application firewall protections and other mitigations in place that morning, before a fix was available. We then updated our production PHP services to the fixed PHP releases the same day, within hours of the fix being released. We’ve reviewed our logs and security monitoring and found no indicators of compromise, and we continue to monitor closely.

Posted Oct 22, 2026 - 09:03 BST

This incident affected: Tillo API and Tillo Content (Content - UK, Content - Europe, Content - Scandinavia, Content - USA & Canada, Content - India, Content - Australia & New Zealand, Content - Middle East).