Mida
Day 13 after signup
Official statement: Mida is not affected by the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Why it works
- Lead with a direct statement about impact so readers can quickly understand whether they need to act.
- Organize technical details into numbered sections that address distinct parts of the product and audience.
- End with a practical next step for readers who need documentation, while keeping the main message reassuring and specific.
How it is built
- Security concern introduction
- Clear impact summary
- Platform explanation
- SDK guidance
- Compliance support and sign-off
Email copy
Hi [First name] [First name], You may have seen news about two recently disclosed vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Several customers have asked whether Mida is affected. This is our official statement. Summary Mida.so is not affected by CVE-2026-109618 or CVE-2026-109619. No action is needed on your Mida account or on the Mida script installed on your website. 1. Mida's platform does not run PHP These vulnerabilities are in the PHP runtime itself. The Mida platform does not use PHP. Our API and backend services run on Node.js. Our dashboard (app.mida.so), website and MCP server are built with JavaScript and hosted on Netlify and Cloudflare. 2. The Mida script on your website is safe The Mida tracking script you install on your site is plain JavaScript, served as a static file from our CDN (cdn.mida.so). No PHP is involved in building or serving it. You don't need to change anything. 3. Nothing to patch on our side No part of our platform uses the affected PHP software, so there is nothing for us to patch for these two vulnerabilities. 4. If you use our PHP SDK (mida-php) Our optional server-side SDK, mida-php, runs on your own servers and only makes HTTPS calls to the Mida API. The SDK is not the cause of these vulnerabilities, which are in PHP itself. If you run PHP anywhere, we recommend updating to a patched version: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. 5. For security and compliance teams You may use this message as Mida's written statement for your security assessment. If you need it in another format, reply to this email and we'll send one. Thank you for trusting Mida. Donald Ng CEO, Mida.so The email was sent to you@example.com. To no longer receive these emails, unsubscribe here.