Please check the latest updates in the comment section below the main body text
Who is affected?
All WoodWing Cloud customers using Studio. This applies to Production and Non-Production Environments in all regions (EU, US and AUS).
When?
Studio environments will be taken offline on Wednesday 21 October 2026 at 10:51 CEST. We expect to restore service after the PHP release becomes available. We will update this article as soon as environments are back online.
What to expect
Studio will be unavailable during this period. Integrations that connect to Studio Server, including InDesign Server automation and Connect Apps, will not work until service is restored.[If applicable:] Assets environments are not affected and remain available.
Why is WoodWing doing this?
The PHP project has announced an upcoming security release addressing two critical vulnerabilities, both rated CVSS 9.2. Details of the vulnerabilities will only be published together with the fix. Because Studio Server runs on PHP, we have decided to take all Studio environments offline as a precaution until the fix is available and has been applied. We consider a short, planned interruption preferable to leaving environments exposed. PHP: News Archive - 2026
What is required?
No action is needed from you for your WoodWing Cloud environments. Please inform your users about the interruption.Customers running Studio Server on their own infrastructure are advised to follow the PHP security release and update PHP as soon as the fixed versions are published. We will publish updated installers and guidance separately.If you have any questions, please contact us via https://helpcenter.woodwing.com/hc/en-us/requests/new?ticket_form_id=12617
Comments
8 comments
Update: Restoring Studio environments with IP-restricted access
While we wait for the PHP fix to be released, we are preparing to bring WoodWing Cloud Studio environments back online with access limited to approved IP addresses.
We will reach out to each customer shortly with instructions on what we need from you. Please keep an eye on your inbox.
Have a print deadline coming up? Contact support so we can give your environment priority.
Is there an email notification list we should be subscribed to to get early notification for events like this? I have a panicked newsroom with a surprise 503 error. Had I known about the upcoming downtime, I could've prepped them.
Hi Chris,
Please “Follow” this announcement, or the whole section. You will then be notified about updates
We would like to add that this PHP security issue is impacting Studio only. None of our other products are impacted.
Update: critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and WoodWing Cloud Studio
On 21 October we took all WoodWing Cloud Studio environments offline as a precaution. This followed the PHP project's announcement of two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could allow remote code execution. We know how disruptive this is for your teams, and we want to restore your service safely and as quickly as possible
Where we are now
The PHP project has published its security fix. However, the packages we normally use to build our WoodWing Cloud environments are not yet available. We expect them soon, possibly tomorrow.
In the meantime, we are already preparing an updated Studio Server build (Studio 10.69) based on today’s PHP release. Before we deploy it to your environment, we want to test it carefully so it does not cause new issues. We do not have an estimate for when we can start deploying yet, but we will update this post as soon as we do.
Getting you back online in the meantime
Until the update is in place, we can restore access to Studio with IP whitelisting. Only the IP addresses you provide, such as your office network or VPN, can then reach your environment. This greatly reduces exposure while the update is rolled out. We expect it to be the main way of restoring access for at least the next 48 hours.
Environments on PHP 8.1 or lower
The PHP project no longer releases new versions for PHP 8.1 and earlier. For these environments, IP whitelisting is the safeguard we can offer. We strongly recommend upgrading to a Studio version that supports a current PHP version, and our team will contact you to plan this with you.
How to request access with IP whitelisting
Please contact us via support. We will send you a short form to confirm your request and list the IP addresses that need access. Please include the addresses of any external integrations that connect to Studio, because integrations that are not listed will not be able to connect. As soon as we receive the signed form, we will enable access for the listed addresses.
Questions?
Please contact us via support or reach out to your account manager. Thank you for your patience and understanding.
Update: PHP patch rollout for Studio 10.69 environments
The PHP packages we need are now available, and we have started patching WoodWing Cloud Studio environments running Studio Server 10.69.
Environments that will be patched
If your Studio URL ends in .woodwing.cloud, your environment runs Studio Server 10.69 and will be patched by us. No action is needed from you. A short interruption may occur while your environment is being patched. We will confirm when your environment has been patched and full access is restored, and we will update this post once the rollout is complete. We will post any further interruptions here.
Other WoodWing Cloud Studio environments
If your Studio URL does not end in .woodwing.cloud, your environment runs a Studio version we cannot patch directly. Until it can be updated, it remains affected by the vulnerability. IP whitelisting reduces the risk but does not remove it, and it remains the way to restore access. If you have not done so yet, please contact support to request the form. We will contact you separately about the options for your environment.
If you are not sure which group your environment belongs to, please contact support.
Update: The PHP security fix has been applied to all WoodWing Cloud Studio environments with URL .woodwing.cloud
Update: Full access restored for .woodwing.cloud environments, and next steps for other versions
Thank you for your patience over the past days. Here is where things stand.
Studio URL ends in .woodwing.cloud
These environments run Studio Server 10.69 and have been updated to a PHP version that includes the fixes for CVE-2026-109618 and CVE-2026-109619. The temporary IP whitelisting has been lifted, and all users and integrations can connect again as before. You don’t need to do anything. If you still notice access problems, please contact support.
Studio URL does not end in .woodwing.cloud
Unpatched Studio Server instances remain affected by the vulnerabilities. IP whitelisting reduces the risk but does not remove it. With the whitelisting form, you confirm the IP addresses that need access and accept the remaining risk while the whitelisting is in place. If you need access before your environment is patched and have not requested it yet, please contact support.
Studio Server versions are supported for 12 months after release (see the Studio End-of-Life Overview). If your environment runs an older version, we strongly recommend upgrading, and our team is happy to help you plan this.
Self-hosted installations
You are responsible for updating your installation. The fix is in PHP, not in Studio Server, so no new Studio Server installer is needed. You only need to update PHP.
Update to the latest patch release of your PHP branch: 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later. On Studio Server 10.39 or lower, check with your Linux or LTS vendor for patched PHP packages, or upgrade Studio Server and PHP. Studio Server 10.11 or older has no safe PHP version available and must be upgraded. Until your installation is updated, limit access to your server as much as possible. The PHP security advisory describes temporary measures, which reduce the risk but do not remove it.
Questions, or not sure which group you belong to?
Please contact support and include your Studio URL, or reach out to your account manager.
Please sign in to leave a comment.