An incident like this shows exactly why a centrally managed platform, backed by an experienced team, matters.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowed attackers to execute code on affected servers without logging in. The issue was in PHP, the technology that powers Drupal and WordPress, among others. Fixing it required a security update to the underlying software.
CERT-EU advised patching immediately and, where that wasn't possible, temporarily isolating publicly accessible applications until the fix had been applied and verified. Our approach followed that guidance. (cert.europa.eu)
Our teams handled the full response:
→ Keeping clients informed by email and with regular status updates.
→ For clients with Dropsolid Edge Shield, activating additional security rules and assessing whether they provided sufficient protection.
→ Proactively putting websites into maintenance mode, including development and test environments.
→ Testing and rolling out the official PHP patch, then bringing websites back online step by step.
→ Continuing to monitor after recovery.
At 20:03 Belgian time, we confirmed that all websites were patched and back online, and that the Dropsolid Platform was fully available.
What makes a platform so valuable during an incident like this?
- Visibility across environments. Managing websites, projects and environments centrally makes it possible to apply measures consistently, including outside production.
- Controlled rollout of updates. Shared deployment processes allow security updates to be tested in a structured way and rolled out across multiple environments.
- Management of the entire technical stack. A website depends on the CMS, the underlying software and the infrastructure. Those layers need to be managed together.
- Clear ownership. Platform management, monitoring and incident response come together in one team that knows the environment. Clients don't have to organise the technical coordination themselves during an incident. (dropsolid.ai, dropsolid.com)
Temporary unavailability has consequences for our clients and their visitors, and we understand that impact. We made this decision in consultation with our partners to limit the risk of unauthorised access and data compromise.
We're proud of the expertise, commitment and collaboration our teams showed. And we thank our clients for their patience and trust.
See the full incident updates and discover how the Dropsolid Platform brings together central management, deployments and security.