In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Oct 23, 2026 - 10:00 CEST
Oct 23, 2026 - 10:00 CEST
Scheduled - On 21 and 22 October 2026, two sets of critical security vulnerabilities were published, one in PHP and one in Node.js. Seven Senders runs both. We patched every customer-facing service within hours of the fixes being released. We have found no sign that either vulnerability was used against our systems.
We have already been in touch with many of you individually. This is our general statement.
WHAT HAPPENED
PHP (CVE-2026-109618 and CVE-2026-109619)
On 21 October the PHP project published two critical remote code execution vulnerabilities. They affect every supported PHP version. An attacker triggers them with a crafted file upload.
Node.js (CVE-2026-111497)
On 22 October the Node.js project published a security release. Its most severe fix is a flaw in the Brotli decoder that permits remote code execution when a service decompresses attacker-supplied data. The same release fixes three high-severity TLS and DNS issues.
WHAT WE DID
PHP
- Before patches were available, we placed web application firewall (WAF) rules in front of every public PHP service and applied the PHP project's recommended mitigations.
- On the evening of 21 October, we paused file uploads in our web portals for a few hours. We announced this on our status page and restored uploads the same evening.
- By the evening of 21 October, we had updated all public services to patched PHP versions.
We kept every service online. We monitored traffic and logs overnight with the incident team on call.
Node.js
- Our exposure was limited. The flaw is reached only when a service decompresses Brotli data from an untrusted source, which our systems do not do.
- On 22 October, we first updated all public services to patched Node.js versions, within hours of the release.
- We then updated our internal tools, build systems and serverless functions, with no data loss.
Communication
- We published an early update on our status page: https://status.sevensenders.com/incidents/3txl2d4zpnwj
- Where we saw a specific need, we contacted individual customers with concrete steps to help secure their systems.
IMPACT ON YOU
- Your data and your integration with Seven Senders were not affected by these vulnerabilities.
- File uploads in our web portals were unavailable for a few hours on the evening of 21 October.
- New 7S Portal users: since the upgrades on 21 October, newly created Portal users may have had problems logging in. Existing users are not affected. We restore access on 23 October.
WHAT WE ASK OF YOU
The same vulnerabilities affect PHP and Node.js systems everywhere: shop systems, ERP and warehouse software, and the plugins and middleware that connect them. An attacker who exploits them can take over the affected system and the data on it. We recommend:
1. Update PHP on every system that runs it.
2. Update Node.js and restart every Node.js process.
3. Rotate credentials held by any system you suspect was compromised, including your Seven Senders API keys. Contact us and we will issue new ones.
To protect the platform, we may temporarily restrict API access from an integration that shows signs of compromise. We will contact you before we do, wherever we can reach you.
STAY INFORMED
Subscribe to our status page for incident notifications: https://status.sevensenders.com/
Oct 23, 2026 10:00 - Oct 24, 2026 10:00 CEST
We have already been in touch with many of you individually. This is our general statement.
WHAT HAPPENED
PHP (CVE-2026-109618 and CVE-2026-109619)
On 21 October the PHP project published two critical remote code execution vulnerabilities. They affect every supported PHP version. An attacker triggers them with a crafted file upload.
Node.js (CVE-2026-111497)
On 22 October the Node.js project published a security release. Its most severe fix is a flaw in the Brotli decoder that permits remote code execution when a service decompresses attacker-supplied data. The same release fixes three high-severity TLS and DNS issues.
WHAT WE DID
PHP
- Before patches were available, we placed web application firewall (WAF) rules in front of every public PHP service and applied the PHP project's recommended mitigations.
- On the evening of 21 October, we paused file uploads in our web portals for a few hours. We announced this on our status page and restored uploads the same evening.
- By the evening of 21 October, we had updated all public services to patched PHP versions.
We kept every service online. We monitored traffic and logs overnight with the incident team on call.
Node.js
- Our exposure was limited. The flaw is reached only when a service decompresses Brotli data from an untrusted source, which our systems do not do.
- On 22 October, we first updated all public services to patched Node.js versions, within hours of the release.
- We then updated our internal tools, build systems and serverless functions, with no data loss.
Communication
- We published an early update on our status page: https://status.sevensenders.com/incidents/3txl2d4zpnwj
- Where we saw a specific need, we contacted individual customers with concrete steps to help secure their systems.
IMPACT ON YOU
- Your data and your integration with Seven Senders were not affected by these vulnerabilities.
- File uploads in our web portals were unavailable for a few hours on the evening of 21 October.
- New 7S Portal users: since the upgrades on 21 October, newly created Portal users may have had problems logging in. Existing users are not affected. We restore access on 23 October.
WHAT WE ASK OF YOU
The same vulnerabilities affect PHP and Node.js systems everywhere: shop systems, ERP and warehouse software, and the plugins and middleware that connect them. An attacker who exploits them can take over the affected system and the data on it. We recommend:
1. Update PHP on every system that runs it.
2. Update Node.js and restart every Node.js process.
3. Rotate credentials held by any system you suspect was compromised, including your Seven Senders API keys. Contact us and we will issue new ones.
To protect the platform, we may temporarily restrict API access from an integration that shows signs of compromise. We will contact you before we do, wherever we can reach you.
STAY INFORMED
Subscribe to our status page for incident notifications: https://status.sevensenders.com/
Oct 23, 2026 10:00 - Oct 24, 2026 10:00 CEST
API
Operational
Label Service - General
Operational
Label Service - Carrier APIs
Operational
Burd DK
Operational
CELERITAS ES
Operational
Ceska Posta CZ
Operational
Colis Prive FR
Operational
Correos ES
Operational
DHL GB - Returns
Operational
DHL NL
Operational
DPD AT
Operational
DPD FR
Operational
Evri UK
Operational
GLS FR
Operational
Hermes DE
Operational
InPost PL
Operational
Poczta Polska PL
Operational
Post AT
Operational
POST NL
Operational
Posti FI
Operational
PostNord SE / DK / FI
Operational
Royal Mail / Intersoft GB
Operational
SDAposteitaliane IT
Operational
Sending ES
Operational
SEUR ES - Returns
Operational
Team C GB
Operational
Yodel GB
Operational
DHL DE Returns
Operational
DHL DE
Operational
Packeta
Operational
Colissimo API
Operational
Anpost IE API
Operational
Label Service - Offline Integration
Operational
An Post IE
Operational
Bpost BE
Operational
Bring SE / DK
Operational
BRT IT
Operational
Colissimo FR
Operational
DHL DE
Operational
DHL ES
Operational
DHL GB
Operational
DHL NL
Operational
DPD AT
Operational
DPD CH
Operational
Mondial Relay FR
Operational
Post AT
Operational
Post CH
Operational
POST NL
Operational
SEUR ES
Operational
Xpressen DK
Operational
Customs
Operational
Seven Senders Portal
Operational
Returns Portal
Operational
Partner Interface
Operational
Transportation Portal
Operational
Tracking
Operational
Tracking
Operational
Shop SQS
Operational
Claims
Operational
PUDO Locator
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.
Scheduled Maintenance
Maintenance – Reprocessing of Royal Mail GB historical tracking data Sep 28, 2026 08:00-10:00 CEST
We're currently reprocessing historical tracking data for Royal Mail (GB). During this time, you may see tracking events and statuses for Royal Mail shipments being updated. This is expected and doesn't need any action from you.
We'll post an update here when the reprocessing is complete. If you have questions in the meantime, please contact our support team.
Posted on Sep 25, 2026 - 16:02 CEST
We'll post an update here when the reprocessing is complete. If you have questions in the meantime, please contact our support team.
Posted on Sep 25, 2026 - 16:02 CEST