Security advisory: PHP vulnerabilities

We are aware of the recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and completed an immediate review of our environment.

Our critical platform services do not run on PHP. We do, however, use a small PHP mail pipe. In simple terms, this is a controlled process that receives incoming email and forwards it into our service so it can be processed correctly. It is not responsible for running our core platform or client-facing services.

The relevant PHP update was automatically applied within hours of becoming available. As a further precaution, we have rotated relevant secure keys and credentials to help protect our clients and their data.

We also maintain additional security controls, including restricted network access that limits external access to sensitive systems, monitoring, and two-factor authentication wherever it is available and appropriate.

At this stage, we have not identified any unauthorised access relating to these vulnerabilities. We will continue to monitor security advisories, logs and our environment as part of our ongoing security practices.

Frequently asked questions

What are these vulnerabilities?
They are security issues in PHP that could allow an attacker to run unauthorised code on an affected and unpatched server.

Was our core platform affected?
No. Our critical platform services do not run on PHP.

What is the mail pipe and why do you use it?
The mail pipe is a small, controlled bridge between incoming email and our service. For example, it allows emails sent to a designated address to be securely received and processed by the platform.

Was the mail pipe updated?
Yes. The applicable PHP update was automatically applied within hours of becoming available.

Have any client accounts or data been compromised?
At this stage, we have not identified any unauthorised access connected to these vulnerabilities.

Why were keys and credentials rotated?
Rotating keys is an added precaution following a high-severity security advisory. It reduces risk even where there is no evidence of compromise.

Do players need to take any action?
No action is required from our players at this time. As always, we recommend using a strong, unique password and enabling two-factor authentication where available.

What protections are in place beyond this update?
We use restricted network access, security monitoring, timely updates and two-factor authentication where possible to reduce the likelihood and impact of unauthorised access.

Will you continue monitoring this?
Yes. We will continue monitoring relevant advisories and our environment, and will take further action if required.

If you have any further questions, please contact us through our contact form.