On 20 October, two critical security vulnerabilities in PHP became known. The vulnerabilities are reported to be actively exploited, and several national security authorities have issued warnings.
Maze confirms the following:
- The Maze service does not run PHP. This covers every part of it: APIs, admin interfaces, integrations, scheduled jobs and internal tools. Maze operates the service itself in a data centre in Norway.
- Our sub-processors are not a risk here. The third parties we use in the service provide services we access via API, and none of them run code in the Maze service.
- Our website, en.mymaze.com, does run WordPress on PHP. It is not part of the service, is hosted separately by an external provider and does not process any data from the service. It was patched on 21 October, the same day the PHP fix was released. At our request, the hosting provider checked the file system for unknown or recently added files and found no signs of unauthorised activity. The provider is also following up with its own subcontractors.
- If an incident ever affects a customer, we handle it under our incident procedure and notify the customer without undue delay. If the customer has a data processing agreement with us, this is in line with that agreement.
In short: the service is not affected, the website was patched the day the fix came out, and nothing suspicious has been found.
