On October 21st, 2026, Infomedia became aware of a critical vulnerability affecting PHP, known as PHP2Shell. Details regarding this vulnerability and PHP’s recommended mitigation measures are available in the PHP project’s security advisory: https://www.php.net/archive/2026.php#2026-10-21-5.
We can confirm that our core mobile payments services do not use PHP and are not affected by this vulnerability. Our technology team have completed a comprehensive investigation into PHP2Shell and found no indicators of compromise in our primary operating environments including mobile payments, messaging, checkout pages, Infomedia content portal and CS portal.
One service was found to be affected by the PHP vulnerability; a content website hosted by Infomedia on behalf of a third party. We communicated this directly to the small number of users of this service and the vulnerability was patched by 17:00 BST on 22nd October 2026.
We do advise all clients to review their own web services for this vulnerability although the presence of the vulnerability on client-side services does not create a vulnerability within the Infomedia platform due to our existing security and connectivity setup.
The security of our services remains a top priority and we continue to work closely with our cyber security providers to ensure the ongoing safety of our platform for clients, suppliers and end users of services.
