Regarding the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619, often referred to as "PHP2Shell"), MarketSpark takes issues like this seriously, and want to share what we have done.
As soon as the vulnerabilities were announced, MarketSpark reviewed our own systems and contacted the suppliers whose platforms, services, and equipment support your MarketSpark service. Here is where things stand:
* MarketSpark's own platform, including Command Center, does not use PHP and is not affected. * Most of our suppliers do not use PHP in the products and services we rely on. * Where PHP was in use, our suppliers have applied the security patches or put recommended mitigations in place. * We have found no evidence that MarketSpark, our suppliers, or your service have been compromised as a result of these vulnerabilities.
No action is needed on your part. We continue to monitor the situation and will reach out directly if anything changes.