Scheduled maintenance is currently in progress. We will provide updates as necessary.
Posted Oct 23, 2026 - 10:00 CEST
Scheduled
On 21 and 22 October 2026, two sets of critical security vulnerabilities were published, one in PHP and one in Node.js. Seven Senders runs both. We patched every customer-facing service within hours of the fixes being released. We have found no sign that either vulnerability was used against our systems.
We have already been in touch with many of you individually. This is our general statement.
WHAT HAPPENED
PHP (CVE-2026-109618 and CVE-2026-109619) On 21 October the PHP project published two critical remote code execution vulnerabilities. They affect every supported PHP version. An attacker triggers them with a crafted file upload.
Node.js (CVE-2026-111497) On 22 October the Node.js project published a security release. Its most severe fix is a flaw in the Brotli decoder that permits remote code execution when a service decompresses attacker-supplied data. The same release fixes three high-severity TLS and DNS issues.
WHAT WE DID
PHP - Before patches were available, we placed web application firewall (WAF) rules in front of every public PHP service and applied the PHP project's recommended mitigations. - On the evening of 21 October, we paused file uploads in our web portals for a few hours. We announced this on our status page and restored uploads the same evening. - By the evening of 21 October, we had updated all public services to patched PHP versions.
We kept every service online. We monitored traffic and logs overnight with the incident team on call.
Node.js - Our exposure was limited. The flaw is reached only when a service decompresses Brotli data from an untrusted source, which our systems do not do. - On 22 October, we first updated all public services to patched Node.js versions, within hours of the release. - We then updated our internal tools, build systems and serverless functions, with no data loss.
Communication - We published an early update on our status page: https://status.sevensenders.com/incidents/3txl2d4zpnwj - Where we saw a specific need, we contacted individual customers with concrete steps to help secure their systems.
IMPACT ON YOU
- Your data and your integration with Seven Senders were not affected by these vulnerabilities. - File uploads in our web portals were unavailable for a few hours on the evening of 21 October. - New 7S Portal users: since the upgrades on 21 October, newly created Portal users may have had problems logging in. Existing users are not affected. We restore access on 23 October.
WHAT WE ASK OF YOU
The same vulnerabilities affect PHP and Node.js systems everywhere: shop systems, ERP and warehouse software, and the plugins and middleware that connect them. An attacker who exploits them can take over the affected system and the data on it. We recommend:
1. Update PHP on every system that runs it. 2. Update Node.js and restart every Node.js process. 3. Rotate credentials held by any system you suspect was compromised, including your Seven Senders API keys. Contact us and we will issue new ones.
To protect the platform, we may temporarily restrict API access from an integration that shows signs of compromise. We will contact you before we do, wherever we can reach you.