This morning, Padmission was briefly unavailable while we applied an urgent security update. We want to explain what happened in plain terms, walk you through the steps we took, and tell you clearly where things stand.
We have no indication that any Padmission system or any client data was compromised. Your data is safe.
What happened
Padmission, like a large share of the websites and web applications in the world, is built on a programming language called PHP. PHP is the engine that runs behind the scenes when you log in, look up a unit, or update a participant’s record.
On Tuesday, October 20, the team that maintains PHP announced that it had found two serious security flaws and would release a fix the next morning. The flaws, known by the tracking numbers CVE-2026-109618 and CVE-2026-109619, could in theory have allowed an outsider to run their own instructions on a web server. Because PHP is used so widely, the issue affected a very large number of websites across the internet, not only Padmission.
Normally, security problems like this are kept confidential until a fix is ready, so that the people who maintain software can repair it before anyone else learns how to take advantage of it. In this case, some details about the problem appear to have leaked before the fix was published.
Why this is not a reason to distrust PHP
Every widely used technology, from phone operating systems to web browsers, receives security updates. Finding and fixing problems is a sign of a healthy, actively maintained system.
The PHP team handled this the way a responsible software project should. They gave the industry advance warning, published fixes for every currently supported version of PHP, and released clear guidance on what to do. Major security providers, including Cloudflare, worked alongside them to protect websites before the fix was even public. PHP continues to be a mature, well-supported foundation, and we remain confident building on it.
What we did, and when
Our development and information security teams were made aware of the vulnerability on Tuesday evening. Full details were not yet available. However, because it appeared that some information about the issue may have already leaked, we did not want to wait and see.
We made the decision to block all access to our systems until the official fix was released and installed. Using the controls our hosting provider gives us, we shut off all incoming traffic to Padmission’s private network. With everything closed off, there was nothing for an attacker to reach.
Here is the timeline:
We were not alone
Taking systems offline until the fix arrived was the step recommended by leading security authorities. According to a Reuters roundup, both the U.S. National Security Agency and CERT-EU, the European Union’s cybersecurity service, advised organizations to take affected websites offline, and many major organizations did exactly that:
- Governments: Finland’s state IT center took government websites offline as a precaution. France’s Interior Ministry, Belgium’s foreign ministry, and Germany’s federal IT service provider did the same, as did Dutch government sites including the national portal Overheid.nl.
- Public institutions: The Port of Rotterdam, numerous hospital websites in the Netherlands, and government, school, and hospital websites across Europe went offline.
- Major organizations: The Wikimedia Foundation, which runs Wikipedia, took down a number of its systems “as a precautionary measure until they can be safely patched.”
Padmission took the same precaution, and we did it on Tuesday evening, as soon as we learned of the risk.
The layers of protection behind Padmission
Our own team is the first line of defense, and it is backed by two partners who specialize in keeping web applications secure.
Laravel Cloud
Padmission is hosted on Laravel Cloud, a hosting platform built and run by the team behind Laravel, the framework Padmission is built on. Part of what we rely on Laravel Cloud for is responding quickly to situations exactly like this one, including keeping the PHP software on our servers up to date. This week, the Laravel Cloud team rolled out the fix to our servers, and we kept our network closed until they confirmed it was complete.
This gives us a second layer of protection. The Laravel team constantly monitors the security of the servers that run Padmission, so even if our own team were ever to miss something, specialists whose full-time job is securing this infrastructure are watching too.
Cloudflare
All traffic to Padmission passes through Cloudflare, a security and network company that sits between the internet and our servers and screens out malicious requests before they ever reach us.
Cloudflare was very proactive here. According to Cloudflare’s own report, it began automatically blocking attempts to exploit this vulnerability at about 10:00 p.m. Central Time on Tuesday, many hours before the official fix was published, and it continued to adapt those protections as attackers tried new approaches.
Because we had already taken our systems fully offline, Cloudflare’s protection did not end up playing a role in this particular event. We still want you to know it is there: it is an additional safeguard that is always working in front of Padmission, every day.
Where things stand now
- Padmission is fully back online and running the updated, patched version of PHP.
- We have zero indication that anything was compromised.
- Client data is fully safe.
Our commitment to you
We know that many of you rely on Padmission throughout your day, and that even a short outage disrupts your work and the people you serve. We sincerely apologize for the downtime.
Protecting the information you trust us with is our highest priority. When we have to choose between a few hours of availability and any risk to your clients’ data, we will always err on the side of caution.
If you have any questions about this event or about how we protect your data, please contact us. We are happy to talk it through.
