Enjoy the freedom of choice

The recent CERT-EU security advisory concerning two critical PHP vulnerabilities has global implications, potentially affecting applications and websites running on PHP, regardless of the company operating them. According to the CERT-EU advisory, the vulnerabilities could affect all PHP versions starting from PHP 5 and may allow unauthenticated remote code execution.

In response to the alert, Vouchers Depot has temporarily isolated internet-facing components of its digital gift card platform and the rewards and incentive platforms it manages for clients. This preventive measure was taken to protect customer, user and partner data from potential exposure until official security patches could be released and applied, and the necessary technical checks completed.

What We Know About the Vulnerabilities

According to CERT-EU Security Advisory 2026-018, the PHP Foundation announced on 20 October 2026 that it was preparing a security update addressing two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.

Both vulnerabilities have a CVSS severity score of 9.2 out of 10 and could potentially allow unauthenticated remote code execution. At the time the advisory was published, technical details had not yet been publicly disclosed.

CERT-EU recommends that organisations identify potentially affected PHP applications and apply security updates as soon as patched versions become available. Where immediate remediation is not possible, organisations are advised to consider isolating internet-facing applications from public networks until a fix can be implemented.

The security patches were scheduled for release on 21 October 2026 at 14:00 UTC (17:00 Romanian time).

The issue has also been covered by Mediafax, in its report on the PHP vulnerabilities and CERT-EU recommendations, Forbes and numerous other international publications.

Preventive Protection for Vouchers Depot and Client Rewards Platforms

Vouchers Depot's decision was aimed at minimising potential exposure while official security fixes were pending. The measures also covered internet-facing components of the rewards and incentive platforms used to manage client reward, incentive and loyalty programmes.

The isolation involved temporarily restricting public internet access to the affected services. This was a precautionary measure to protect systems and data, not an indication of a confirmed security breach.

Cosmin Lăcătușu, General Manager, Vouchers Depot, stated:

"We decided to proactively isolate the internet-facing components of the Vouchers Depot platform and the rewards and incentive platforms we manage for our clients to prevent their data from being exposed to the identified risk. We understand that a temporary service interruption may affect ongoing programmes, but protecting our clients and partners remains our top priority. Access will be restored once the official security patches have been released and applied, and all necessary technical checks have been completed."

Vouchers Depot Services Have Been Restored

Depot services have resumed, and the platforms managed for clients have been brought back online.

Some gift cards from Europe and USA may still have limited availability while their respective suppliers complete their own security updates.

Vouchers Depot continues to monitor the situation in coordination with its partners to ensure full catalogue availability is restored.