Hi [First name] [First name],

You may have seen news about two recently disclosed vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Several customers have asked whether Mida is affected. This is our official statement.

Summary
Mida.so is not affected by CVE-2026-109618 or CVE-2026-109619. No action is needed on your Mida account or on the Mida script installed on your website.

1. Mida's platform does not run PHP
These vulnerabilities are in the PHP runtime itself. The Mida platform does not use PHP. Our API and backend services run on Node.js. Our dashboard (app.mida.so), website and MCP server are built with JavaScript and hosted on Netlify and Cloudflare.

2. The Mida script on your website is safe
The Mida tracking script you install on your site is plain JavaScript, served as a static file from our CDN (cdn.mida.so). No PHP is involved in building or serving it. You don't need to change anything.

3. Nothing to patch on our side
No part of our platform uses the affected PHP software, so there is nothing for us to patch for these two vulnerabilities.

4. If you use our PHP SDK (mida-php)
Our optional server-side SDK, mida-php, runs on your own servers and only makes HTTPS calls to the Mida API. The SDK is not the cause of these vulnerabilities, which are in PHP itself. If you run PHP anywhere, we recommend updating to a patched version: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.

5. For security and compliance teams
You may use this message as Mida's written statement for your security assessment. If you need it in another format, reply to this email and we'll send one.

Thank you for trusting Mida.

Donald Ng
CEO, Mida.so