22 October 2026

Following the recent disclosure of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, Prolateral has completed an initial audit of its infrastructure and services to assess potential exposure.

The vulnerabilities could allow an unauthenticated attacker to execute code on affected systems running vulnerable versions of PHP. We took the reports seriously and prioritised reviewing our infrastructure, applying security updates and addressing any identified risks.

What we found

Our assessment confirmed that Prolateral’s core email services, including outMail, proFilter, proEmail, backupMX and fakeMX, were not affected by these vulnerabilities.

As part of the wider infrastructure review, we identified systems requiring security updates and applied the relevant patches. Our management and support platforms have also been updated, alongside applicable web hosting environments.

Where updates could not be applied immediately, we worked directly with the affected customers to implement appropriate mitigations. Where necessary, websites have been taken offline until the risks can be addressed satisfactorily.

Security monitoring and ongoing action

We have reviewed relevant access logs for signs of suspicious activity associated with these vulnerabilities. At the time of publication, our review has identified no evidence of activity indicative of exploitation of CVE-2026-109618 or CVE-2026-109619.

We will continue to monitor our infrastructure, review emerging security information and address any further issues identified. Should subsequent investigation identify a missed vulnerability or additional risk, we will prioritise the necessary remediation and take appropriate action.

Based on our assessment to date, we have identified no impact on the security, availability or integrity of emails processed by our core email relay services as a result of these vulnerabilities.

Our commitment to security

Protecting our customers’ data, services and communications is central to everything we do. We recognise the importance of acting quickly when new security threats emerge, and we remain committed to maintaining the security, reliability and integrity of the services our customers depend on.

Ian Chilvers (Operations Director) commented, “The security of our customers’ data and services is a responsibility we take extremely seriously. As soon as these vulnerabilities were reported, our team carried out a review of our infrastructure, applied the necessary updates and addressed the risks identified. Security is an ongoing process, and we will continue to monitor developments and take prompt action wherever further work is required

We will continue to assess the situation as further information becomes available and take any additional action necessary to protect our customers and their services.