Mindtickle incident
PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”)
Resolved on October 21, 2026.
Summary • Two critical vulnerabilities in the PHP runtime (“PHP2Shell”) were publicly disclosed on Oct 21, 2026. • The Mindtickle platform, including customer learning sites and custom-domain deployments, is built primarily on Go, JavaScript, TypeScript, Python, and Java, and is not affected. Affected component • One supporting component used PHP: the backend service for the in-app “Report an issue” feedback form. It is separate from the help-article search and chat features in the same support panel, which run on other services and are not affected. • It serves the feedback form and receives a report when a user submits one. The service forwards the report to our support team’s helpdesk. • It runs separately from the core Mindtickle platform. It is not part of how learning sites are served, how users sign in, or how learning content and tenant data are stored or processed. It has no access to the systems that hold that data. Remediation • On Oct 23, 2026, we applied the mitigating configuration changes recommended in the PHP security advisory to reduce the risk of exploitation while we prepared the upgrade. • On Oct 24, 2026, we upgraded the component to PHP 8.3.36, the fixed release, across all production regions and verified the fix. • We also added a request-filtering control as a defense-in-depth measure. The component remained in service throughout, with no downtime. Investigation • We reviewed logs from Oct 20, 2026, the day before public disclosure, through remediation on Oct 24, 2026. • We found no evidence of exploitation and no evidence that any customer data was accessed or exposed. No action required • There is no need to rotate passwords, API keys, SSO settings, or integration credentials. • We continue to monitor and will update this page if anything changes. • For questions, supporting evidence, or a formal attestation, email [email protected].
Update timeline
- resolved Oct 24, 2026, 01:19 PM UTC
Summary • Two critical vulnerabilities in the PHP runtime (“PHP2Shell”) were publicly disclosed on Oct 21, 2026. • The Mindtickle platform, including customer learning sites and custom-domain deployments, is built primarily on Go, JavaScript, TypeScript, Python, and Java, and is not affected. Affected component • One supporting component used PHP: the backend service for the in-app “Report an issue” feedback form. It is separate from the help-article search and chat features in the same support panel, which run on other services and are not affected. • It serves the feedback form and receives a report when a user submits one. The service forwards the report to our support team’s helpdesk. • It runs separately from the core Mindtickle platform. It is not part of how learning sites are served, how users sign in, or how learning content and tenant data are stored or processed. It has no access to the systems that hold that data. Remediation • On Oct 23, 2026, we applied the mitigating configuration changes recommended in the PHP security advisory to reduce the risk of exploitation while we prepared the upgrade. • On Oct 24, 2026, we upgraded the component to PHP 8.3.36, the fixed release, across all production regions and verified the fix. • We also added a request-filtering control as a defense-in-depth measure. The component remained in service throughout, with no downtime. Investigation • We reviewed logs from Oct 20, 2026, the day before public disclosure, through remediation on Oct 24, 2026. • We found no evidence of exploitation and no evidence that any customer data was accessed or exposed. No action required • There is no need to rotate passwords, API keys, SSO settings, or integration credentials. • We continue to monitor and will update this page if anything changes. • For questions, supporting evidence, or a formal attestation, email [email protected].
Your product runs on more than Mindtickle
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services