Information only: Givecloud has applied the official PHP security updates across its PHP environments to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell.”

Our assessment is that Givecloud’s exposure was limited by our platform configuration and by Cloudflare’s WAF protections, which were in place before public disclosure. We have also applied the PHP updates, the complete fix recommended by the PHP maintainers.

We want to reassure you that services have not been impacted by these security vulnerabilities. No action is required by customers. Everything has been handled by Givecloud.

Protecting your organization and your donors' information is a responsibility we take very seriously. You can continue using Givecloud with confidence, knowing the necessary protections and updates are in place.

More information: PHP security advisory · CVE-2026-109618 · CVE-2026-109619 · Cloudflare’s update · UK NCSC guidance

Our team has deployed a fix and the issue appears to be resolved. We continue to monitor to ensure things are running smoothly.

Our team has identified the issue and is working on a fix. Issue is specific to Giving Experience donation forms using the billing info screen (i.e. manual credit card entry).

We're currently investigating an issue affecting Giving Experience donation forms, where the "Give" button is disabled for users after entering their name, email and address information.

We’re actively working to resolve this and will keep you updated as more information becomes available.

At this time, the issue appears to be limited to Giving Experience donation forms only, with no workaround.

Our best people are on it, and your trust means everything to us. Thank you for your patience as we work to restore things fully.