You may have seen recent reports about two newly disclosed security vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Several customers and partners have asked us whether Mail & Deploy is affected, so we want to give a clear answer: Mail & Deploy is NOT affected by either vulnerability, and you don’t need to take any action.
We take the security of your reporting environment and the data that moves through it seriously. When widely discussed vulnerabilities like these are published, we want you to hear from us quickly. Below we explain what the issues are, why Mail & Deploy isn’t affected, and what we’re doing to stay on top of them.
What are the vulnerabilities?
CVE-2026-109618 and CVE-2026-109619 are security vulnerabilities in PHP, the scripting language used by a large share of websites and web applications. Systems running affected PHP versions are exposed, and administrators are advised to install the fixes published by the PHP project. Details are available in the official advisories: GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
Because PHP is so widely used, these vulnerabilities have received a lot of attention, and many organizations are currently reviewing their software and suppliers.
Why Mail & Deploy is not affected
Our security and engineering teams reviewed both vulnerabilities as soon as they were disclosed and checked all supported versions of Mail & Deploy. We confirmed that Mail & Deploy is not affected because it does not include any PHP components. CVE-2026-109618 and CVE-2026-109619 can only affect systems that run PHP, so these vulnerabilities cannot be exploited through Mail & Deploy.
This applies to all supported versions of Mail & Deploy.
Do I need to do anything?
No. You don’t need to update Mail & Deploy, change your configuration, or apply a workaround because of CVE-2026-109618 or CVE-2026-109619.
As always, we recommend keeping the rest of your environment up to date. If other software on the same server uses PHP, such as a web server or another application, check with those vendors whether their products are affected and install their recommended updates.
What we’re doing
Although Mail & Deploy is not affected, we will keep monitoring the situation. If new information comes to light, for example related vulnerabilities or changes to the scope of the original issues, we will review it promptly and update this post.
Security reviews like this one are part of our ongoing work to keep Mail & Deploy secure. We continuously track vulnerabilities in third-party components and dependencies and respond quickly when something could affect our customers.
Questions and support
If you have questions about this notice, need confirmation for your own security or compliance review, or would like more details, please contact our support team at community.mail-and-deploy.com. Partners can also reach out to their usual contact at info@mail-and-deploy.com.
Thank you for your trust in Mail & Deploy.
