- RESSOURCEN
- Blog
- EventMarket
- FAQ
- Global
- Sicherheit
- Bibliothek
- Nachrichten
Einer unserer Vertriebsmitarbeiter wird sich in Kürze mit Ihnen in Verbindung setzen.
ATLANTA, GA — October, 2026 — InEvent, the all-in-one event management platform trusted by organizations and government agencies worldwide, today confirmed that it applied the emergency PHP security update addressing the PHP2Shell vulnerabilities across its platform in less than two hours after the PHP project released the fix on October 21, 2026.
The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are two critical remote code execution flaws in PHP itself, each rated 9.2 on the CVSS v4.0 scale. Because PHP powers an estimated seven in ten websites, the security industry treated the disclosure as an emergency. Details of the flaws leaked online on October 20, ahead of coordinated disclosure, and security researchers reported exploitation attempts in the wild soon after.
InEvent’s engineering and security teams prepared for the update before its release. On the morning of October 21, InEvent notified customers through its Trust Center (https://trust.inevent.com/) that it would apply the patch as soon as it became available, explained what to expect during a short maintenance window, and pointed customers running live events to its support team.
When PHP released the fixed versions at 10:00 AM EDT (14:00 UTC), InEvent applied the update across the platform in less than two hours. The incident was marked resolved on the Trust Center, where the full timeline remains publicly available.
“When a vulnerability this serious hits a technology that runs most of the web, speed is everything, but so is communication,” said Mauricio Giordano, Chief Technology Officer and Co-Founder of InEvent. “We told our customers what was coming before the fix was released, we patched the platform within two hours, and we kept every step public on our Trust Center. Event teams trust us with their attendees’ data. Protecting it can’t wait for a convenient time.”
Event platforms hold some of the most sensitive data an organization collects: attendee names and contact details, travel and accessibility information, payment data and, for government and healthcare events, regulated information. A remote code execution flaw would allow an attacker to run commands on a vulnerable server, which is why security researchers stressed that applying the official update is the only complete fix.
InEvent serves government agencies in the United States and around the world, along with enterprise organizations in regulated industries. Security, privacy and data protection are core pillars of the platform. InEvent holds SOC 2 Type 2 compliance, audited by A-LIGN, and ISO 27001 certification (https://inevent.com/en/government/iso-27001-event-software.php), and supports HIPAA, PCI DSS, and GDPR requirements. Details are published on its Data and Security page (https://inevent.com/security-data-privacy.php).
Is InEvent affected by PHP2Shell?
InEvent applied the official PHP security fix for CVE-2026-109618 and CVE-2026-109619 across its platform less than two hours after the PHP project released it on October 21, 2026.
Do InEvent customers need to take any action?
No action is required on the InEvent platform. Customers with questions can contact their InEvent account manager or InEvent support.
Where can customers see the incident timeline?
The full timeline is published on the InEvent Trust Center at trust.inevent.com.
InEvent is an enterprise event management platform for in-person, hybrid, virtual, and webinar experiences. Organizations and government agencies worldwide use InEvent to manage event registration, websites, attendee communications, onsite check-in and badge printing, mobile event apps, engagement, analytics, and AI-powered event workflows from one connected platform. Learn more at inevent.com.
