Our public-facing websites and services have not been affected by the PHP2Shell vulnerabilities.
We have undertaken an assessment of our public-facing websites and services to establish whether any were exposed to the PHP2Shell vulnerabilities or may have been compromised prior to patches being applied. Our assessment found that our public-facing websites and services have not been affected.
Our assessment covered the following:
Exposure of our below listed public-facing websites and services to the PHP2Shell vulnerabilities, a security issue that enables attackers to execute malicious code on vulnerable PHP-based systems tracked as CVE-2026-109618 and CVE-2026-109619, plus an additional vulnerability CVE-2026-115560.
- BigCommerce: Our B2B e-commerce websites use the BigCommerce platform, which has confirmed that its services are not affected by the PHP2Shell vulnerability. We do not run any custom PHP-based applications alongside BigCommerce. BigCommerce does not run PHP in a manner that exposes it to this issue, but have nevertheless patched their servers, as almost all versions of PHP are affected.
- Streamdays: Our Streamdays platform does not use php in any of its operations. A third-party provider we use patched its systems in a timely and non-disruptive manner.
- WordPress: Our WordPress website is hosted by a third-party provider, who has confirmed that all necessary patching has been completed.
- Other public-facing services: We reviewed all other technologies used by the public services we operate to assess their potential exposure.
- Root-level investigations into data access patterns.
Our assessment is limited to the systems and services within our operational control, and the information provided by our third-party providers. We will continue to monitor relevant security developments and take the required actions where necessary.
