Resolved after 9 hours 22 minutes, on October 21, 2026.
We have now successfully applied the relevant PHP patches and we will continue to monitor our logs and systems to ensure everything remains stable.
Update timeline
- monitoring Oct 21, 2026, 11:02 AM UTC
Today the PHP project is releasing security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (known as “PHP2Shell”, CVSS v4.0 9.2), which could allow unauthenticated remote code execution on servers running unpatched PHP. Does Mention Me use PHP? Yes, parts of the Mention Me platform run on PHP. As a precaution, we have disabled all uploads via our firewall/WAF, based on industry recommendations. This is precautionary, and not as a result of any monitoring or active threat we have seen. Patch status: The PHP project has scheduled the patched releases for 15:00 BST today. We will deploy the patched version across all affected services at 15:00 BST, or sooner if PHP publishes the release earlier. Any sign of exploitation? We have reviewed our security monitoring and logs, and have found no indication that these vulnerabilities have been exploited against Mention Me. We will continue to monitor this closely. Do you need to do anything? No action is needed on your side for Mention Me. If your own shop or hosting runs PHP, we recommend confirming with your provider that it has been patched. We’ll post another update once the patch is deployed. If you have any questions, please contact your Customer Success Manager.
- resolved Oct 21, 2026, 08:24 PM UTC
We have now successfully applied the relevant PHP patches and we will continue to monitor our logs and systems to ensure everything remains stable.
Your product runs on more than Mention Me
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services