PHP vulnerabilities: What happened?
On the evening of 20 October 2026, two critical security vulnerabilities in PHP – CVE-2026-109618 and CVE-2026-109619 – came to light, collectively known as ‘PHP2Shell’. Both vulnerabilities could allow arbitrary code to be executed on a server.
Due to the global prevalence of the PHP programming language, this is a worldwide security issue affecting numerous providers and websites. The patches announced for 22 October 2026 were released on schedule. Operators of affected systems should install the published updates as a matter of urgency.
This is how mailbox responded
At mailbox, the security of our users and their data is our top priority. Our team therefore convened immediately after the PHP security vulnerabilities came to light to check all potentially affected systems and assess the level of urgency. We implemented protective measures even before the official updates were released. When the official patches were released on 22 October 2026, we applied them to the affected systems immediately and did the same with any subsequent patches. We continue to monitor and analyse developments very closely and are constantly assessing whether further measures are necessary.
None of mailbox’s core systems were affected by the PHP security vulnerabilities, and at no point were any services online that could have put our customers at risk in any way. mailbox can continue to be used securely and as usual.
