QC Database was in the middle of retiring an old legacy server (pqshome.com) that was reaching EOL (end of life) of the operating system. We were moving the old legacy app to a more modern setup using a newer version of PHP. We had planned on testing this new server thoroughly, but on 10/21/26, the FBI released an announcement of two critical vulnerabilities in PHP which are collectively known as PHP2SHELL.
These vulnerabilities allow attackers to take control of any PHP server. Even the version of PHP that we were upgrading to was impacted by these CVE's.
NOTE: QC Database did not experience an intrusion from this event. All of the bugs were caused by a rushed rollout of a new server.
On Saturday night, we shut down our old vulnerable server, upgraded the new server to a secured and patched PHP version, and then worked to get it online as fast as possible. We did this without testing QC Database with the new PHP version installed. This rushed deployment caused our customers experienced several serious bugs: - Missing NDE report files - Drawings stuck on the loading screen - Flanges causing pages to crash if set to type "other" - Old URL's not working i.e. printed QR Codes and bookmarks - some other small issues
We apologize for the confusion this caused. In normal circumstances, we would have thoroughly tested our new stack before deploying, but we made a decision to launch this new server in an attempt to minimize downtime with a plan of fixing the bugs as they presented themselves.
The alternative to this rushed rollout would have been a total shutdown of QC Database for 4 to 5 days as we worked on fixing, testing, and deploying a new version of the legacy app. This is what the FBI recommended for servers that could not be upgraded: Total shutdown.
You can read more about the CVE's here: https://www.vulncheck.com/blog/php2shell-vulnerabilities
If your company has custom apps, please investigate them now:
