On 21 October 2026, PHP released security updates addressing two vulnerabilities affecting several supported PHP versions. One of Weply's systems, the User Management System (UMS), was running an affected version of PHP.
We updated the system to a patched version on 22 October 2026. As an additional precaution, access to the UMS was temporarily restricted while the update was prepared and applied.
Our assessment has not identified indications that the vulnerabilities were exploited or that unauthorised access or a personal data breach occurred. We are continuing to monitor the system and are planning additional infrastructure hardening as a further security measure.
What was affected?
The affected component was Weply's User Management System (UMS). It supports administrative and operational functions across Weply, including:
- User information: Information relating to client users, internal users and chat consultants.
- Payment processing: Functions related to processing payments.
- Agent certifications: Management of chat consultant certifications.
- Subscription management: Administration of client subscriptions.
The UMS was running PHP 8.2.30, which was affected by the vulnerabilities addressed in the October security release.
The vulnerabilities concerned the PHP runtime environment. This does not mean that the functions or data handled by the UMS were themselves vulnerable, nor does it indicate that any information was accessed or compromised.
Weply's live chat service was not the component affected by this PHP update.
The vulnerabilities
On 21 October 2026, PHP published security updates addressing two vulnerabilities:
- CVE-2026-109618: A vulnerability in PHP affecting supported versions. Depending on the circumstances, successful exploitation could affect the security or operation of a system running a vulnerable version.
- CVE-2026-109619: A separate vulnerability in PHP addressed in the same security release. Depending on the circumstances, successful exploitation could affect the security or operation of a system running a vulnerable version.
The vulnerabilities affected multiple supported PHP branches. PHP published patched releases for the following versions: PHP 8.2, PHP 8.3, PHP 8.4, PHP 8.5. Systems running earlier, unsupported PHP versions may require a version upgrade rather than a security patch.
What did Weply do?
We took steps to reduce exposure while preparing and applying the security update.
The PHP update has been completed. The additional infrastructure work is intended to strengthen the system's security beyond the immediate vulnerability remediation.
Data and security assessment
As part of our response, we assessed the potential exposure and reviewed the available security information.
At the time of writing, we have not identified indications that the vulnerabilities were exploited, that unauthorised access occurred, or that personal data was compromised.
The UMS handles user and account information relating to clients, internal users and chat consultants. Depending on the account and functionality involved, this may include information such as names, email addresses and phone numbers, as well as information used for payment processing, certifications and subscription administration.
It is important to distinguish between information handled by a system and information confirmed to have been accessed. Our assessment has not identified evidence that this information was accessed or extracted through exploitation of the vulnerabilities.
We will continue monitoring and reviewing relevant security information. Should our assessment change, we will inform affected clients in accordance with our contractual and legal obligations.
What does this mean for Weply clients?
The affected component was the UMS, which supports administrative functions such as user management, payments, certifications and subscriptions.
Access to the UMS was temporarily restricted as a precaution while the security update was prepared. This may have affected access to some administrative functionality during that period.
The PHP update was completed on 22 October 2026. We have not identified indications of a personal data breach related to these vulnerabilities.
No action is currently required from clients in relation to this specific PHP update.
Frequently asked questions
Was Weply's live chat service affected?
The identified affected component was the User Management System (UMS), not the live chat service itself. The UMS supports administrative and operational functions, including user information, payment processing, agent certifications and subscription management.
What information could the affected system access?
The UMS handles information relating to client users, internal users and chat consultants. This can include names, email addresses and phone numbers, as well as information associated with payments, certifications and subscriptions.
This describes the types of information handled by the system. It does not mean that this information was accessed or compromised.
Was any data compromised?
Our assessment has not identified indications that the vulnerabilities were exploited, that unauthorised access occurred, or that personal data was compromised.
We will continue monitoring and will communicate with affected clients if new findings change this assessment.
What steps did Weply take?
We temporarily restricted access to the UMS as a precaution and upgraded its PHP environment from version 8.2.30 to the patched version 8.2.35 on 22 October 2026.
We are also planning additional infrastructure hardening to prevent direct public-internet access to the UMS.
Was the UMS unavailable during the update?
Access to the UMS was temporarily restricted while the update was being prepared and applied. This may have affected some administrative functionality during that period.
Is any action required from clients?
No action is currently required from clients in relation to this specific update.
Questions or concerns?
If you have questions about Weply's response or how these updates relate to the services we provide, please contact your Weply Customer Success Manager or reach us at support@weply.dk.
We take the security of our infrastructure and the data entrusted to us seriously. We will continue to monitor the situation and communicate any material changes to our assessment that could affect our clients.