Today the PHP project is releasing security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (known as “PHP2Shell”, CVSS v4.0 9.2), which could allow unauthenticated remote code execution on servers running unpatched PHP.

Does Mention Me use PHP? Yes, parts of the Mention Me platform run on PHP. As a precaution, we have disabled all uploads via our firewall/WAF, based on industry recommendations. This is precautionary, and not as a result of any monitoring or active threat we have seen.

Patch status: The PHP project has scheduled the patched releases for 15:00 BST today. We will deploy the patched version across all affected services at 15:00 BST, or sooner if PHP publishes the release earlier.

Any sign of exploitation? We have reviewed our security monitoring and logs, and have found no indication that these vulnerabilities have been exploited against Mention Me. We will continue to monitor this closely.

Do you need to do anything? No action is needed on your side for Mention Me. If your own shop or hosting runs PHP, we recommend confirming with your provider that it has been patched.

We’ll post another update once the patch is deployed. If you have any questions, please contact your Customer Success Manager.