We have patched the software and are rolling out updates throughout the night. As soon as all environments have been patched, we will post another update.

Rabbit is temporarily offline

Status: Offline as a precaution

Today we took Rabbit offline as a precaution. Two serious security vulnerabilities have been found in PHP, the programming language Rabbit runs on. In the worst case, they allow an attacker to run their own code on a server without logging in. The vulnerabilities are in PHP itself, not in Rabbit's software, and they affect websites worldwide. See the NOS live blog for more information: https://nos.nl/liveblog/2636066-websites-kwetsbaar-voor-softwarelek-rtl-nieuws-digid-en-mijnoverheid-uit-de-lucht

What this means for you: the Rabbit environment and the app are unavailable until we bring Rabbit back online.

What we are doing: the PHP maintainers expect to release a fix today at 4:00 PM (CEST). As soon as it is available, we will install it on all our servers and test that everything works securely. Only then will we turn Rabbit back on. We will post an update here as soon as we are back online.

Questions? Email support@rabbit.nl. The security of your data comes first.

A security vulnerability has been disclosed in PHP, the underlying technology of our backend. The CVEs concerned are CVE-2026-109618 and CVE-2026-109619.

We are following this closely. As soon as a patched PHP version is available, we will update our environments as quickly as possible. We will then post an update here.

You do not need to take any action yourself. If you have any questions, please contact our support team.