11:50 Investigating: Our platform is temporarily offline as a precaution due to two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). There are no signs of exploitation. We’ll be back online once the patches are applied and will update this page as soon as we know more.
13:20 The patch for the security vulnerability is not yet available. Therefore, there is no new status update to report at this moment. However, in response to various questions we have received, the following FAQ is prepared:
Are the payment pages and API connections accessible?No, the payment pages are currently offline as well, and API calls are not being executed during the maintenance.
What happens to import scripts, flows, and automated messages?All other messages, including submissions via import scripts and scheduled flows, are postponed until after the security update. As soon as the platform is live again, these will be resumed.
14:06: The status remains unchanged.
15:05: The status remains unchanged.
16:15: PHP has now officially released the patch and it needs to be updated on the underlying operating systems. Once that is done, the patch will be available for POM. We are monitoring this continuously so that we can install the patch as soon as it becomes available. More information about the vulnerability can be found at
php2shell.com17:17: Updates are being rolled out in phases across the previously mentioned operating systems. As soon as this is available for POM, it will be implemented in POM's systems.
18:03: The status remains unchanged.
18:36: We have started patching our PHP instances.
18:57: Our back-end processes are running again.
19:00: Payment pages are available again.
19:03: API is back online (api.mailtopay.nl).
19:08: Portal is back online (collect.pom.eu).
22-10 09:20: Now that the patch has been succesfully installed and systems are operational again, we will continue to monitor the situation closely and remain alert for any potential consequences.