On October 21, 2026, two critical security vulnerabilities affecting PHP, a programming language widely used to run web services across the internet, were publicly disclosed (CVE-2026-109618 and CVE-2026-109619, commonly referred to as “PHP2Shell”).
As soon as the vulnerabilities were announced, Meescan’s engineering team assessed every part of our platform and took the following steps:
- Applied vendor security updates to all affected systems where updates are available.
- Implemented additional protective controls across our cloud infrastructure, in line with the official security guidance published for these vulnerabilities. These include filtering and limiting incoming traffic at the network edge, isolating request processing, and disabling features our services do not use.
- Reduced our attack surface by restricting access to internal diagnostic interfaces.
- Increased capacity and redundancy so the platform keeps performing reliably with these protections in place.
- Continuing to monitor our systems and the security research community, and we will act promptly if further information emerges.
We have found no evidence that these vulnerabilities were exploited against Meescan systems.
No action is needed from libraries or patrons. Meescan apps, kiosks and self-checkout services continue to run normally.
The security of our customers and their patrons is our highest priority. If you have questions, please contact our support team at support@meescan.com.
Peter Trenciansky Chief Technology Officer |