Assessment and Response to PHP Core Runtime Vulnerabilities

Executive Summary

On October 21, 2026, security researchers disclosed critical memory-corruption vulnerabilities affecting the PHP runtime core, collectively known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619).

In response, the Security team, in coordination with the engineering and security leads across our portfolio companies—Kahoot!, Motimate, Actimo, DragonBox, and Drops—initiated an immediate, group-wide risk and exposure assessment.

Key Findings:

• Core Product Platforms & Customer Data: Unaffected. None of the production applications, customer portals, or core microservices across Kahoot!, Motimate, Actimo, DragonBox, or Drops utilize PHP in their application stacks. Customer data and platform services remain fully secure.
• Corporate & Marketing Websites: Patched & Secured. Corporate marketing web properties hosted on WordPress via WP Engine have been updated; WP Engine has confirmed that all underlying PHP instances across our accounts are fully patched.
• Forensic Review: Our Security Operations team completed an audit of all available logs provided by WP Engine across our environments and found no indicators of compromise (IoCs), abnormal requests, or evidence of exploitation.

Brand-Specific Scope & Impact Assessment

Detailed Findings & Remediation

1. Core SaaS Infrastructure & Platforms (All Brands)

• Across Kahoot!, Motimate, Actimo, DragonBox, and Drops, our production platforms, databases, identity providers, and API backends are built on modern cloud architectures running non-PHP runtimes.
• These production environments are logically, physically, and architecturally separated from any public marketing websites, preventing any lateral movement or cross-contamination.

2. Corporate Marketing Web Infrastructure (WP Engine)

• Runtime Patching: WP Engine deployed platform-wide mitigations to resolve the PHP2Shell vulnerabilities at the engine level across all production and staging instances used for our public marketing sites.
• Log Forensic Analysis: The Security team reviewed all available access, runtime, and edge logs from WP Engine. This analysis confirmed no malicious memory-exhaustion payloads, abnormal traffic patterns, or unauthorized administrative activity.

Ongoing Posture & Next Steps

1. Continuous Telemetry: We maintain strict edge-level monitoring and Web Application Firewall (WAF) filtering across all external domains to block exploit payloads targeting PHP runtime vulnerabilities.
2. Third-Party Risk Management: Our vendor security governance program is auditing our external SaaS vendors and digital supply chain partners to verify their remediation posture.
3. Cross-Entity Governance: Security leadership across Kahoot!, Motimate, Actimo, and DragonBox continues to share real-time threat intelligence and maintain aligned defensive baselines.

Conclusion

There has been no compromise, no data exposure, and no operational impact to Kahoot!, Motimate, Actimo, DragonBox, or Drops, or to any of our customers. Corporate marketing websites have been patched, forensically reviewed, and verified clean.