Last updated: 22 October 2026, 12:28 AM CET.
Current status: MCS web applications temporarily offline. Awaiting vendor patch.
Next update: By 23 October 11 AM CET., or sooner if there is a significant development.
Latest status
Our MCS web applications remain temporarily offline as a precaution following the reported PHP vulnerabilities. Dependent services are also disrupted, as detailed below.
Zend, the vendor supporting the PHP platform used by MCS, currently expects to release the required patch on Friday, 23 October 2026. The exact release time and compatibility with our environment are awaiting confirmation.
After receiving a compatible patch, Spacewell expects to require one additional day for installation, testing, and safety checks.
Our current restoration target is Saturday, 24 October 2026, provided the patch arrives on 23 October and validation is successful. This is an estimate, not a confirmed restoration time.
We understand the disruption this is causing. Our teams are following up with Zend and preparing for safe restoration.
What is affected?
| Application or service | Current impact |
|---|---|
| MCS web applications | Temporarily unavailable. |
| MCS Windows desktop applications | Not directly affected by these PHP vulnerabilities. Functionality dependent on unavailable web applications or services may be disrupted. |
| Interfaces (with MCS) | Affected interfaces are paused to prevent repeated failures. They will resume once MCS web applications are available and the relevant teams confirm they can restart. |
| Exchange synchronization (with MCS) | Users can create meetings in Outlook, but these will not synchronize with MCS reservations during downtime. Reconciliation will be required after restoration to reflect changes in MCS. |
| Mobile applications link with MCS (such as Mobile Work Manager, Mobile Service Request, Inspection app, Meeting Room displays) | Unavailable during downtime. Expected to resume normal operation once MCS web applications are restored. |
| Spacewell Workplace, previously known as Cobundu, using MCS as its backend | The touchpoints (such as GO, Mobile Workplace app & Kiosk) remains accessible, but reservations cannot be completed. Service requests, work orders, and floorplan updates are also impacted. Floorplan viewing is limited to sensor data. Reservation data is unavailable. |
The Workplace impacts above apply specifically to environments using MCS as their backend (for managing assets).
Why are the MCS web applications offline?
Two critical vulnerabilities have been reported in the PHP runtime used by our MCS web applications. Our environment is within the potentially affected scope.
Successful exploitation could allow unauthorized commands to run on an affected server, potentially exposing data, compromising the server, or disrupting services.
We have taken the servers offline to reduce potential exposure while awaiting a compatible, vendor-supported patch or validated remediation guidance.
This is a precautionary measure, not confirmation of an attack or data breach. We have not confirmed exploitation in our environment. The vulnerabilities concern the underlying PHP runtime rather than an identified defect in MCS application code.
What is Spacewell doing?
Spacewell is coordinating with Zend Support and our security team to obtain a compatible patch, confirm installation requirements, and review interim mitigation guidance.
Our teams are preparing backups, rollback arrangements, deployment activities, and application testing.
Restoration process and timing
Zend’s estimated patch release date is 23 October 2026. This is not the service restoration date.
After receiving the appropriate patch, Spacewell expects to require one additional day to:
- Confirm compatibility and deployment arrangements.
- Complete backups and prepare rollback options.
- Install the patch and test critical functionality.
- Complete safety checks before restoring access.
The conditional restoration target remains 24 October 2026. Delays in patch availability, compatibility issues, or findings during testing may change this estimate.
We will confirm the deployment window once the patch has been received and assessed.
Dependent services may require additional follow-up. Interfaces need confirmation before restarting, and Exchange changes require reconciliation. Restoring access does not mean reconciliation is complete.
Updates and support
This article is the central reference for service status, customer impact, and restoration estimates.
Our next update will be published by October 23 11 AM CET., even if there is no change. Significant developments will be shared sooner.
We will also email affected customers about important developments, revised restoration estimates, and confirmed restoration.
For questions specific to your environment or business impact, please contact Spacewell Customer Support by submitting a ticket.
We recognize the business disruption caused by this precautionary shutdown. Our priority is to restore services safely, and we will continue to keep you informed as work progresses.
Update history
22 October 2026, 7:01 CET
MCS web applications remain temporarily offline while Spacewell awaits the required vendor-supported patch.
Reservations in Spacewell Workplace, previously known as Cobundu, are also affected for customers who use MCS as their backend or asset management system. The Workplace web application remains accessible, but reservations cannot be completed.
Zend’s estimated patch release date remains 23 October 2026. Spacewell’s conditional service restoration target remains 24 October 2026, subject to patch availability, compatibility, and successful validation.