Parts of StatusCake’s infrastructure were affected by two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell.

Ahead of the official patch release on 21 October, we applied precautionary mitigations and temporarily took potentially affected services offline. Services were restored following engineering assessment and security updates along with additional protections. Remediation of these two vulnerabilities is complete.

We also reviewed logs for signs of exploitation, including activity before public disclosure. The checks completed to date found no evidence of compromise.

Please contact our support team if you have any questions.