PHP2Shell Response

Incident Report for Nutshell

Resolved

This incident has been resolved.

Posted Oct 21, 2026 - 13:25 EDT

Update

We are continuing to monitor for any further issues.

Posted Oct 21, 2026 - 10:14 EDT

Monitoring

Nutshell is aware of the PHP2Shell security vulnerability and we have taken steps to secure any affected servers. A few services were unable to be properly secured without risk of attack, and have been temporarily disabled. We expect these services to be re-enabled later this morning when a patch has been applied.

The following services are affected:
- Landing pages hosted on custom domains
- Email link tracking using custom domains
- Scheduler pages hosted on custom domains

Posted Oct 21, 2026 - 10:14 EDT

This incident affected: Nutshell application and Nutshell Marketing outgoing email.