Status
Information regarding PHP vulnerabilies CVE-2026-109618 and CVE-2026-109619 PHP2Shell
Oblak on runs 1 service that was affected, Nextcloud.
Until the patch we had mitigations in place to block malicious requests. Only authenticated Oblak users were able to interact with the PHP code, so we estimate the risk rather low. Upon investigation there are no indications of any compromise.
The Nextcloud service is now fully patched.
If you have any questions, or experience issues using Nextcloud, don't hesitate to reach out.
No known issues, all systems operational
Uptime statistics
You can check the real-time status from all our service via the link below.
Report problems
If you experience a problem with one of our services, please contact us:
Warrant Canary
This is our Warrant Canary.
Until today (1st of November 2026) we have not been contact by some form of Law Enforcement. We will update this message the 1st of December 2026.
Public Key
Use our public key to verify the Warrant Canary Signature.
Our key is also available at keys.openpgp.org
gpg --import operations.gpg
Next, download the signature and the message file
To conclude verify the signature and the message:
gpg --verify signature.sig warrant-canary.md
The output should be:
gpg: Signature made Sun 01 Nov 2026 01:45:37 PM CET
gpg: using RSA key D920D049C73450821F6D2858A53EA51C95F3AFEA
gpg: issuer "operations@oblak.be"
gpg: Good signature from "operations@oblak.be " [unknown]
gpg: WARNING: The key's User ID is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: D920 D049 C734 5082 1F6D 2858 A53E A51C 95F3 AFEA