Back to ChangelogBack to Changelog

PHP security update: Ecomail is secure

PHP's maintainers released patches for two critical vulnerabilities, and Ecomail updated all servers immediately after the patches were released.

FIX

PHP security update: Ecomail is secure

PHP's maintainers released patches for two critical vulnerabilities, CVE‑2026-109618 and CVE‑2026-109619, which would have let an attacker run arbitrary code on a server without knowing any password. The vulnerability did not originate in Ecomail ‑ it affects every server running PHP. Immediately after the patches were released, we updated PHP on all Ecomail servers to the latest version, reviewed our infrastructure, and we continue monitoring traffic for suspicious activity. If you use Ecomail only through the web interface, you don't need to do anything ‑ your account is safe. If you have your own PHP‑based website, e‑shop or application connected to Ecomail, check the PHP version on that server and update it to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 ‑ that's typically where the API key is stored. If you suspect the key may have leaked, generate a new one in Settings ‑> Integrations ‑> API key. Not sure how to proceed? Forward this message to your developer or hosting provider.

CVE-2026-109618

CVE-2026-109619

newsletterStay up to date

Once in a while, we will send a summary of new features, improvements, and fixes to your inbox. No spam, no marketing – just product updates from Ecomail.