You trust us with your box office, your members and your audience's details, so when something serious happens in the software underneath TheatreHQ, you should hear about it from us, in plain English. Here's what happened on 21 October, and what we did about it.
What happened
TheatreHQ, like a large part of the web, is built on a programming language called PHP. On Tuesday 21 October 2026 the PHP team released urgent fixes for two critical security flaws. Later that afternoon CERT-EU, the cybersecurity service for the EU's institutions, published an advisory (2026-018) urging everyone running PHP to update straight away.
Both flaws scored 9.2 out of 10 for severity. In the worst case they could let an attacker run their own code on a web server without logging in, and examples of how to do it were already circulating. That's the kind of problem you fix the same day, not at the next convenient moment.
What we did
- Every live TheatreHQ site was patched within an hour of the fix being released, onto the corrected version of PHP.
- Our own systems, including this website and the tools we use to support you, were patched the same evening.
- Extra protection: on our own servers we also switched off a PHP feature we don't use, which CERT-EU identified as one of the routes the attacks take, so that route stays closed whatever happens next.
After each update we checked the corrected version was running and that sites, box offices and admin pages were working as normal.
Do you need to do anything?
No. Your TheatreHQ site is looked after for you, so there's nothing to install, update or restart. Your shows, bookings and member records are all just as you left them.
If your group also runs other websites or software of its own, it's worth asking whoever looks after them whether they've been updated, because the flaws affect any server running PHP, not just TheatreHQ.
Why this matters
Most amateur theatre groups don't have an IT department, and nobody joined the committee to read security advisories. That's part of what you're paying for: when something like this comes out, it's our job to notice, act quickly and tell you, so your volunteers can get on with the show.
If you have any questions about this update or about how we look after your data, just get in touch. You can also read more about how we keep TheatreHQ secure.
