On October 21, we had to take Lokalise offline for 1 hour and 30 minutes at short notice to apply an emergency security fix. We apologize for any disruptions that may have been caused.

What happened. On October 21 at 14:00 UTC the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Both allow unauthenticated remote code execution, meaning an attacker could run code on an unpatched server without any credentials. Details leaked publicly on October 20, before a fix was available, and widespread exploitation was expected as soon as the fix was released. Parts of the Lokalise platform run on PHP, so these vulnerabilities applied to us.

What we did. As soon as the advance notice was published, we prepared the upgrade and scheduled an emergency maintenance window to begin at 14:00 UTC, when the patched versions became available. We took the Lokalise application, API and Lokalise Messages offline, updated PHP to the fixed versions across all affected systems, verified the deployment, and restored service at 15:30 UTC.

Delaying would have left a known critical vulnerability open while attacks were already being reported elsewhere. A short service downtime was the lower risk.

More information

PHP advisory: https://www.php.net/archive/2026.php#2026-10-21-5

If your security team would like a summary for your vendor risk records, or wants to discuss this with us, please contact your Customer Success Manager or security@lokalise.com.

Magnus Slind-Naslund
CTO at Lokalise