Information on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("php2shell")

On 21 October 2026, two critical security vulnerabilities in the PHP programming language were disclosed. We would like to inform you whether and how our services were affected.
The Magicline platform, in which your members’ data is processed and stored, is not affected by these vulnerabilities. We use PHP only in a small number of auxiliary systems outside the platform. None of these systems processes the data we process on your behalf, and none provides access to systems in which that data is stored. Our subprocessors do not use PHP in the services relevant to you.

We took the affected auxiliary systems offline as a precaution immediately after the vulnerabilities became known. Once the security updates were released, we updated the systems and brought them back online the same day.

We then examined the affected systems for signs of exploitation, including the period before the patch. The investigation covered, in particular, inbound access logs, the integrity of persistently stored data and the application runtime environment. No signs of compromise were found.

Based on the results of our investigation, there is therefore no personal data breach within the meaning of Art. 4(12) GDPR affecting the data we process on your behalf. Should any indication of access to your data arise later, we will inform you without undue delay in accordance with Art. 33(2) GDPR and our data processing agreement.