PHP Security Vulnerabilities: Why We Temporarily Took Clockodo Offline as a Precaution

On October 21, 2026, Clockodo was temporarily unavailable between 1:23 p.m. and 6:21 p.m. The reason was newly disclosed security vulnerabilities in the PHP programming language, which is also used by Clockodo.

Security vulnerabilities of this severity are extremely rare: They were classified as critical, with a severity score of 9.2 out of 10, and could have allowed attackers to execute malicious code remotely on affected servers. Even the EU's cybersecurity team recommended taking affected applications offline if necessary.

After carefully weighing the risks, we therefore made the deliberate decision to take Clockodo offline until the security update could be installed. The application has been fully available again since 6:21 p.m.

Based on our investigation so far, there is no evidence that the vulnerabilities were exploited in our systems or that customer data was affected.

Why did we temporarily take Clockodo offline?

On October 21, critical security vulnerabilities in PHP were disclosed. PHP is a programming language used worldwide, including by Clockodo. The vulnerabilities were therefore not in Clockodo itself but affected applications worldwide that use the vulnerable PHP versions.

As the necessary security updates were not yet available, we decided to take Clockodo offline as a precaution. This approach is also in line with the security recommendations of CERT-EU, the European Union's cybersecurity team. CERT-EU recommends temporarily taking affected applications offline if necessary until a security update can be installed.

The security updates were released later that same afternoon, and we installed them immediately. Clockodo has been fully available again since 6:21 p.m.

How long was Clockodo unavailable?

On October 21, 2026, we assessed the newly disclosed security vulnerabilities and initiated the necessary measures.

• 7:40 a.m.: Our development team learns about the security vulnerabilities in PHP. We begin investigating their potential impact on Clockodo. At this point, the full extent of the vulnerabilities and the risks they pose to all publicly accessible PHP applications are not yet widely known.
• 11:24 a.m.: Our support team receives the first customer inquiry regarding the security vulnerabilities.
• 12:34 p.m.: Our development team informs management of its latest assessment of the security vulnerabilities and their potential impact on Clockodo.
• 12:48 p.m.: We decide to take Clockodo offline as a precaution and initiate the necessary steps.
• 1:23 p.m.: Clockodo is temporarily taken offline.
• 3:56 p.m.: PHP officially announces the release of the security updates. We begin installing them.
• 6:21 p.m.: The updates have been installed, and Clockodo is fully available again.
• 10:45 p.m.: Our website, clockodo.com, is also back online.

Has my data been affected?

Based on our investigation so far, there is no evidence that the security vulnerabilities were exploited in our systems. We have also found no indication of unauthorized access to customer or employee data.

Our investigations are still ongoing. We are focusing particularly on the period from October 17, 2026, as public reports indicate that the first attack attempts were observed around that time. Since the vulnerabilities may have existed for some time before then, it is not possible to comprehensively investigate the entire period.

If, contrary to expectations, new findings emerge that require us to notify our customers, we will of course inform you accordingly.

All customer data and time entries saved before the shutdown have been fully preserved. Restoring data from a backup was not necessary.

What does the outage mean for your time tracking?

During the shutdown, the Clockodo web interface, API, and smartphone apps were affected. Time tracking via the smartphone apps was still possible to a limited extent.

If you recorded your work and project times manually during the outage, you can now add them to Clockodo as usual. Simply enter the relevant date, start and end times, and assign the entry to the appropriate customer and project.

All time entries saved before the shutdown are still fully available.

What happens next?

The security updates were successfully installed on October 21. Since then, Clockodo has been available as usual.

We are continuing our investigations in the background. At present, there is no evidence that your data has been compromised.

We would make the same decision we made on October 21 again without hesitation. At the same time, we are using this experience to develop strategies to keep Clockodo available for as long as possible, even in such exceptional circumstances.

We understand that an interruption to time tracking can be disruptive to your daily work, and we apologize for any inconvenience caused. Thank you for your understanding during this precautionary shutdown.

If you have any further questions, our Customer Success team will be happy to help. Feel free to contact us at any time by email at support@clockodo.com or by phone at +49 2303 676687-8.