All Systems Operational

About This Site

Lookatme receives Common Vulnerabilities and Exposures (CVE) alerts directly from the Australian Government as part of our cybersecurity monitoring programme. Each CVE provides a globally recognised reference number for a publicly disclosed security issue so that organisations can discuss the same threat with shared terminology.

REAL-TIME CVE UPDATES
When we receive a CVE alert that may relate to our technology stack, we immediately create an incident entry on the Lookatme CVE Status Page. This ensures that clients and auditors can see the current situation in real time.

For each CVE report, this CVE Status Page shows:
- the initial CVE notification
- investigation progress updates
- confirmation of resolution
- a post-mortem describing the analysis and outcome

EMAIL ALERTS
Clients and stakeholders who subscribe to the Lookatme CVE Status Page will receive email updates as soon as:
- a CVE alert is logged,
- the investigation progresses, or
- the issue is fully resolved.

CVE ASSESSMENT AND REPORTING
We use internal tooling that analyses the CVE information against the exact versions and configurations of all components in our environment. This allows us to determine quickly whether the issue is applicable and whether action is required.

The CVE Status Page provides:
- transparency for clients
- assurance for internal and external auditors
- a reliable record of our response to cybersecurity events
- a consistent protocol for CVE management across all teams

This helps demonstrate that CVE alerts are reviewed, documented, and actioned in a structured and accountable way.

Uptime over the past 90 days. View historical uptime.
Common Vulnerabilities and Exposures Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance
Major outage
Partial outage
No downtime recorded on this day.
No data exists for this day.
had a major outage.
had a partial outage.

No incidents or maintenance related to this downtime.

Oct 27, 2026

No incidents reported today.

Oct 26, 2026

CVE-2026-111497 Node.js and CVE-2026-96889 Next.js Vulnerabilities
Resolved - Incident status: Resolved

Following the security advisories published in October 2026 for Node.js and related components, we have reviewed the Lookatme7 platform and applied the vendor patches to every environment, including your production site. Below is a summary for your IT team.

What was patched

1. Node.js runtime (the server runtime for the platform's APIs and websites)
Advisory: Node.js October 2026 security release, 21 October 2026. It fixes 10 vulnerabilities, including a high-severity flaw in Brotli decompression with potential for remote code execution.
Previous version: 24.14.1
Now running: 24.22.1, the patched release on the Node.js 24 long-term support line

2. sharp image-processing library (generates previews and derivatives from uploaded images)
Advisory: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a memory-safety flaw in SVG image processing on Linux
Previous version: 0.35.0
Now running: 0.35.5

3. Next.js web framework (the platform's web front ends)
Advisory: Next.js security update, 14 October 2026
Fixed: GHSA-p3m5-59mp-jv5r (denial of service through crafted requests)
Assessed as not applicable: GHSA-673q-mjm6-r5xr, a remote code execution flaw that requires a framework feature the platform does not use. The SVG processing flaw in the same advisory is resolved by item 2.
Previous version: 16.3.3
Now running: 16.4.1


*How the patches were applied
Every platform service was rebuilt on updated base images and redeployed to our test, staging and production environments in turn. Each service was confirmed healthy after deployment. The patches were live in production on [date].

*Exposure assessment
At the time of patching, the vendors had reported no exploitation of these vulnerabilities in the wild. [Include only if confirmed by Matt: We also reviewed our server logs for the period before patching and found no indicators of compromise.]

*Ongoing monitoring
We scan the platform's running container images daily against published vulnerability databases. We raise and remediate fixable high and critical findings as part of our standard release process.

Lookatme continues to monitor Node.js and Next.js security advisories and will post any further updates here. For questions, please contact support@lookatmedam.com.

Thank you,
Lookatme Cyber Security Team
Oct 26, 19:39 AEDT
Monitoring - *Component: Common Vulnerabilities and Exposures
Lookatme has identified two security releases that apply to the Lookatme7 platform. A patch release is scheduled for tonight, 26 October 2026, after business hours (AEDT).

*Node.js – CVE-2026-111497
On 21 October 2026, the Node.js Project issued security releases fixing ten vulnerabilities across all supported Node.js release lines. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decompression library bundled with Node.js, with potential for remote code execution.
Lookatme will upgrade Node.js to 24.22.1, the patched release for the 24.x line.

*Next.js – CVE-2026-96889 and GHSA-673q-mjm6-r5xr
On 14 October 2026, the Next.js team at Vercel issued Next.js 16.4.1, fixing two critical remote code execution flaws – one in SVG image processing through the sharp image library, and one in Cache Components – along with a denial-of-service flaw.
Lookatme will upgrade the Lookatme7 frontend to Next.js 16.4.1 in the same release.

Lookatme will post a further update here once the release is complete. For questions, please contact support@lookatmedam.com.

Thank you,
Lookatme Cyber Security Team
Oct 26, 15:39 AEDT

Oct 25, 2026

No incidents reported.

Oct 24, 2026

No incidents reported.

Oct 23, 2026

No incidents reported.

Oct 22, 2026

CVE-2026-109618 and CVE-2026-109619 PHP Vulnerabilities
Resolved - *Component: Common Vulnerabilities and Exposures
Lookatme has completed a full review and mitigation of the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 across all Lookatme environments. All Lookatme services remain available and secure.

*Lookatme7
The Lookatme7 DAM platform runs entirely without PHP. Lookatme7 sites sit outside the scope of these vulnerabilities.

*Lookatme6
The Lookatme6 core web application runs on PHP 5.3.3, which predates the affected range (PHP 5.4 and later).
Two supporting Lookatme6 servers within the affected range – authentication and media ingestion – have been patched and restarted.
Clients using single sign-on through the Lookatme6 authentication service will move to Lookatme7 as a priority. Lookatme will contact each of these clients directly.
Lookatme6 stage and test environments are now restricted to Lookatme network addresses.

*Drupal servers
Lookatme runs Drupal servers solely for client integration testing and staging. Client production sites run independently of these servers.
The Lookatme servers have been patched, then restricted to Lookatme network addresses or stopped.
Lookatme legacy website pages and Lookatme UK corporate website run on separate Drupal servers, independent of the Lookatme DAM service. These servers have been patched and restarted.

Lookatme continues to monitor PHP security advisories and will post any further updates here. For questions, please contact support@lookatmedam.com.

Thank you,
Lookatme Cyber Security Team



タイトル： CVE-2026-109618 および CVE-2026-109619 PHP 脆弱性 – Lookatme6 の緩和措置完了

ステータス： 解決済み

*コンポーネント： 共通脆弱性識別子（CVE）
Lookatme は、PHP の脆弱性 CVE-2026-109618 および CVE-2026-109619 について、すべての Lookatme 環境を対象とした包括的な確認と緩和措置を完了しました。すべての Lookatme サービスは引き続きご利用いただけ、安全に稼働しています。

*Lookatme7
Lookatme7 DAM プラットフォームは PHP を使用せずに稼働しているため、Lookatme7 のサイトは本脆弱性の影響範囲外です。

*Lookatme6
Lookatme6 のコア Web アプリケーションは PHP 5.3.3 で稼働しており、影響を受けるバージョン範囲（PHP 5.4 以降）より前のバージョンです。
影響範囲に該当する Lookatme6 の補助サーバー 2 台（認証、メディア取り込み）にパッチを適用し、再起動しました。
Lookatme6 の認証サービス経由でシングルサインオンをご利用のお客様は、優先的に Lookatme7 へ移行いたします。対象のお客様には Lookatme より個別にご連絡いたします。
Lookatme6 のステージング環境およびテスト環境は、現在 Lookatme のネットワークアドレスからのみアクセス可能です。

*Drupal サーバー
Lookatme が運用する Drupal サーバーは、お客様との連携テストおよびステージング専用です。お客様の本番サイトはこれらのサーバーとは独立して稼働しています。
これらのサーバーにはパッチを適用した上で、Lookatme のネットワークアドレスに限定するか、停止しました。
Lookatme のブログおよび英国向けウェブサイトは、Lookatme DAM サービスとは独立した別の Drupal サーバーで稼働しています。これらのサーバーにもパッチを適用し、再起動しました。

Lookatme は引き続き PHP のセキュリティアドバイザリを監視し、追加情報があればこちらに掲載いたします。ご不明な点は support@lookatmedam.com までお問い合わせください。

よろしくお願いいたします。
Lookatme サイバーセキュリティチーム
Oct 22, 11:57 AEDT

Oct 21, 2026

No incidents reported.

Oct 20, 2026

No incidents reported.

Oct 19, 2026

No incidents reported.

Oct 18, 2026

No incidents reported.

Oct 17, 2026

No incidents reported.

Oct 16, 2026

No incidents reported.

Oct 15, 2026

No incidents reported.

Oct 14, 2026

No incidents reported.

Oct 13, 2026

No incidents reported.

Incident History Powered by Atlassian Statuspage