Statement: PHP vulnerability

Incident Report for TapRaise

Resolved

This incident has been resolved.
Posted Oct 21, 2026 - 16:49 CEST

Monitoring

A fix has been implemented for Backstage and we are monitoring the results.
Posted Oct 21, 2026 - 16:14 CEST

Identified

Most importantly, the TapRaise Fundraising Platform (tapraise.app) and Field Apps are not affected. This means sign-ups can continue as usual.

However, Backstage customers are partly affected but we have mitigated exposure by implementing a IP restriction. IPs that we’re previously known to us are whitelisted so they can go ahead and keep using their Backstage instance. Any other new or unknown IP may be blocked from using it to mitigate security risks. This results in a 403 error message (which is expected). We anticipate to roll out security updates later today and open up traffic to all IPs after that.
Posted Oct 21, 2026 - 15:16 CEST

Investigating

TapRaise fundraising platform (http://tapraise.app) is not affected.

We are actively mitigating the risks of Backstage customers which may lead to operational downtime. However, keeping everything operational remains our first priority.
Posted Oct 21, 2026 - 14:49 CEST
This incident affected: TapRaise and Backstage.