Valimail is the leading provider of automated DMARC enforcement solutions, dedicated to protecting organizations from email-based threats and enhancing email deliverability. We adhere to industry-leading standards, including FedRAMP LI-SaaS and SOC 2 Type II, to demonstrate our dedication to security best practices. Explore our certifications, policies, and reports to learn more about how we protect your organization.
Trust Center Updates
Valimail status: PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Summary
Valimail is not affected by CVE-2026-109618 and CVE-2026-109619, the critical remote code execution vulnerabilities in PHP core disclosed on October 21, 2026. No customer action is required.
Details
PHP is not used in the Valimail platform or in any infrastructure component that delivers our services. Following the disclosure, our security team reviewed our production environment to confirm no PHP exposure within our service boundary. Our vulnerability scanning tooling has been updated with detections for both CVEs and continues to run on its regular cadence.
Impact assessment
No affected assets were identified. There is no impact to the confidentiality, integrity, or availability of Valimail services, and we have found no evidence of exploitation or unauthorized access related to these vulnerabilities in our environment.
Customer action
None required.
Questions
Customers who need a formal written attestation for their third-party risk process can request one through their account team or at security@valimail.com. We will update this post if our assessment changes.