Trust Centre

What occurred and timeline
On October 20, PHP announced two critical vulnerabilities affecting websites and applications that use PHP. The vulnerabilities could allow unauthorized code execution through specially crafted requests. Exploitation details were publicly available before the official fix was released, which increased the risk while Maple was still running the affected software.

Maple implemented interim protections overnight and in the early morning of October 21, including disabling the affected functionality and deploying additional protections to block known exploitation attempts.

At approximately 10:05 a.m. ET on October 21, Maple took the platform offline as a precaution. This decision was made because the vulnerability was critical, exploitation details were public, and the team wanted to eliminate exposure while the official fix was deployed and validated. Consultations and other platform activity were paused during the outage.

The official security patch was deployed to the production web application at approximately 11:11 a.m. ET. Internal monitoring confirmed the remediation at approximately 11:21 a.m. ET, and the platform was restored at 11:22 a.m. ET. The total interruption was approximately one hour and seventeen minutes.

Remediation and restoration checks
The response included:

• Applying the official security patch.
• Temporarily disabling the affected functionality until the patch was deployed.
• Implementing additional protections to block exploitation attempts.
• Taking other potentially exposed environments offline while their exposure was assessed.
• Testing the patched platform before production deployment.
• Reviewing security records and confirming the remediation before restoring access.

Security review and potential information impact
Based on the review completed to date, we found no evidence that either vulnerability was successfully exploited, no evidence of unauthorized access to Maple systems, and no identified loss, corruption, or exfiltration of Maple data.

The review included relevant access, application, and security records. It found no indicators of unauthorized activity, compromise, data loss, corruption, or exfiltration. Malicious-looking requests identified during the review were blocked by our web application firewall.

Platform functions and integrations
Following restoration, all platform functionality was observed operating normally. We've had no indications of issues with the platform since it was brought back up.

Remaining actions and monitoring
The remaining actions we will be taking:

• Continue heightened monitoring of all systems.
• Complete our standard post-incident retrospective, to identify any areas of improvement in our response process.

At present, the identified impact is limited to the temporary service interruption, and no impact to Maple data has been identified.