Creatia and our bare metal management portal are back online and have been operating normally for the past few hours. Your network services and DDoS protection have continued to operate normally throughout.
Our quick action in isolating all systems running PHP or Node.js, which also had several serious vulnerabilities disclosed today including a remote code execution flaw, has kept our environment secure. No indicators of compromise have been detected. Your services remain secure and unaffected.
Our billing portal remains offline until patched PHP versions are released for our hosting platform, which is expected within the next few hours. We have chosen not to apply workarounds or rely on a WAF to bring it back sooner, as we believe this is the right choice given the risks involved.
Current status: Creatia: Online Bare Metal Management: Online Billing: Offline until patched PHP versions are available
Support can still be accessed by emailing support@globalsecurelayer.com. Emails continue to be triaged as normal through our ticketing system, which has not been affected.
Posted Oct 21, 2026 - 20:03 UTC
Update
Your network services and DDoS protection continue to operate normally. Existing mitigation rules, filters and routing remain in place and are enforced as configured.
Creatia and our other portals run on PHP, and until the fix is available and applied we have chosen to take the portals offline rather than leave it exposed as a precautionary measure.
What PHP has announced: A security release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC (Thursday, October 22 at 1:00 AM GMT+11 local time). It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. Full details, affected versions and fixed versions will only be published when the release is made. PHP may release earlier if details of either vulnerability become public, or if active exploitation is seen in the wild.
The PHP project has announced upcoming security patches addressing several potentially high-severity vulnerabilities.
We have completed an assessment of our environment and have found no affected systems. Your services remain secure and unaffected.
As an additional precaution, we are temporarily taking PHP based systems offline until the patches are released and applied. We expect this to be completed within 24 hours.
Posted Oct 21, 2026 - 01:00 UTC
This incident affects: Customer Portals (Support and Billing, Bare Metal Management, Protection Reporting, Protection Managment (Creatia), Remote Protection Management (Mercury)).