Two critical PHP vulnerabilities shook the internet last week. Known as “PHP2Shell”, CVE-2026-109618 and CVE-2026-109619 let attackers run code on web servers without even logging in.
If you’ve seen the headlines, you’re probably wondering whether your email is safe.
Your Mailfence account is not affected. Your email, documents, calendar, and contacts remain fully protected. Here’s what happened and why you can keep using Mailfence as usual.
What is PHP2Shell?
PHP2Shell refers to two critical security flaws (CVE-2026-109618 and CVE-2026-109619) in PHP, the programming language that powers roughly 75% of all websites.
The PHP project released patches on October 21, 2026. But watchTowr confirmed active exploitation on that same day, with attempts traced back to October 17.
Why doesn’t PHP2Shell affect Mailfence?
Here’s the reassuring part: Mailfence does not use PHP for its service.
Because PHP2Shell targets PHP server environments specifically, the attack path simply doesn’t exist on our systems.
PHP’s core runtime isn’t part of our technology stack – so your Mailfence data was never exposed to these vulnerabilities.
How we responded
Even though our systems aren’t directly vulnerable, we treat every major security event seriously.
Our security team reviewed all systems as soon as the disclosure became public. That included a full audit of ancillary services and third-party dependencies.
For our public-facing blog and knowledge base pages, protective patches had been installed by our hosting provider before the official updates were even released.
At no point were Mailfence accounts or user data at risk. We continue to monitor developments closely.
What should you do?
If Mailfence is your email home, you don’t need to take any action. Your account is safe.
However, PHP2Shell may affect other services you use. Self-hosted platforms, WordPress sites, and web applications running PHP are all potentially vulnerable.
Here’s what we recommend:
- Update any PHP-based services immediately. If you run your own websites or applications, patch to the latest PHP version right away.
- Watch for phishing emails. Major vulnerabilities often trigger phishing campaigns posing as “urgent security updates.” Don’t click suspicious links.
- Turn on two-factor authentication. If you haven’t activated 2FA on your Mailfence account yet, now is a great time.
- Use strong, different passwords for each service. A password manager makes this easy. If one account gets compromised elsewhere, your Mailfence email stays safe.
Why your email provider’s architecture matters
PHP2Shell is a powerful reminder that what’s under the hood of your email service matters enormously.
A single vulnerability in PHP exposed millions of websites and applications overnight. The technology choices your email service made years ago suddenly become the difference between safe and compromised.
Mailfence was built with security as a core principle from day one. That includes:
- End-to-end encryption with OpenPGP: only you and your recipient can read your emails
- Encryption at rest protecting stored data on our servers
- Belgian privacy law and GDPR compliance: no advertising, no tracking, no backdoors
Questions? Reach out to us at support@mailfence.com.
