In this blog, we explain what happened, how we responded, and what questions you can ask your fulfilment partner.
What Happened: The PHP Vulnerability of October 2026
On 21 October, two critical security vulnerabilities were discovered in PHP. At that time, a so-called Proof of Concept was already available: a technical demonstration showing how the vulnerabilities could be exploited. PHP had not yet released any updates to patch the vulnerabilities. Those updates were announced around 4 pm The National Cyber Security Centre (NCSC) published a notice that same day stating that there were indications of actual exploitation.
PHP is one of the most widely used programming languages on the web. Many online shops, platforms and logistics systems (about 70%) run on it. As a result, a problem in PHP can quickly affect thousands of organisations at once.
Why Your Fulfilment Partner’s IT Matters
As an online shop, you outsource your logistics—and with that, a large part of your IT. Your orders flow through integrations with your e-commerce platform, marketplaces and carriers. If one link in the chain fails, your customers will notice it immediately.
If you are a customer of a fulfilment provider that was affected by the outage on 21 October 2026, you will recognise the following issues:
- Orders are not arriving at the warehouse, or are arriving late.
- Parcels miss the cut-off and are delivered a day later.
- Stock isn’t updated in your online shop, so you end up selling products that are no longer in stock.
- Track & trace information is no longer accurate.
- Your customer service team receives questions that you can’t answer yourself.
Especially during busy periods, such as the run-up to Black Friday and Christmas, even a few hours of downtime can cost a lot in lost revenue and customer trust.
How Monta Manages Its IT
At Monta, we develop and manage our systems ourselves. That gives us the flexibility to adapt quickly.
A few principles we follow:
ISO 27001-certified. Our information security has been assessed in accordance with the international ISO 27001 standard. This means that we systematically identify risks, respond quickly to threats and incidents, and evaluate our approach through internal and external audits.
Separate systems. Our external websites operate independently of the WMS, order processing and our warehouses. This means that a problem on a website won’t affect your orders.
When in doubt, we err on the side of caution. For example, we temporarily took our external websites offline until everything had been updated and verified.
Up-to-date software. We systematically keep our software stack up to date and do not use outdated versions. We run our systems exclusively on modern, highly secure platforms.
Fixed patch policy and continuous monitoring. We implement security updates quickly and in a controlled manner. We often detect anomalies before they have any impact.
Failover and backup. We use a full failover replica and have a comprehensive backup strategy that complies with current standards.
When it became clear that the vulnerabilities were being actively exploited, we didn’t wait around. As a precaution, we took our external websites offline. Our operational systems are intentionally separate from the websites, so the WMS and order processing continued as usual. At the same time, we kept a particularly close eye on the connections with our partners. We kept our customers informed via our software and by email.
— Rachel Egas, Head of IT at Monta
Your supply chain partners matter, too
Many partners in the supply chain do run on PHP: carriers, e-commerce platforms, plug-ins, and other software with integrations. If they experience a security breach or shut down their systems, you’ll notice it, for example, in:
- Deliveries and tracking with carriers;
- your online shop’s checkout process;
- your returns portal;
- orders that come in via an integration.
That’s why, during this incident, we kept a particularly close eye on the integrations and the order flow. If we noticed anything at a partner that affected customer orders, we immediately notified them via MontaPortal (our software).
4 Questions to Ask Your Fulfilment Partner
Are you unsure how well your logistics are protected? Ask these questions of your current or future fulfilment partner:
- How can we tell that you value information security?
- What happens to my orders if your systems go down?
- How will I be notified of system outages?
- Who monitors the connections to my online shop and carriers outside of business hours?
In conclusion
Incidents like this show just how dependent online shops are on the technology behind their logistics. At Monta, we see reliable IT as the foundation of good fulfilment – just as important as fast and accurate picking or custom packaging.
Would you like to know how Monta processes your orders reliably and on time, even during the busiest periods?
Personal & flexible
25+ years of experience
99.98% performance guarantee
