Malakium Trust & Transparency

Current security investigation

Status: Investigation completed — no direct exposure found in the Malakium systems examined.

On 21 October 2026, the Netherlands National Cyber Security Centre published advisory NCSC-2026-0443 on CVE-2026-109618 and CVE-2026-109619, jointly known as PHP2Shell. Both PHP vulnerabilities are rated critical (CVSS 9.2 out of 10). In the PHP 8.2, 8.3, 8.4 and 8.5 branches, versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 respectively are affected; those four versions contain the fixes. Older PHP versions may require updates from their suppliers. On 22 October 2026, we investigated the Malakium Website and Backend/API environments. No active PHP runtime was present in the environments examined. We therefore found no direct exposure to these two PHP vulnerabilities in those components. The investigation is complete for these components as examined. This conclusion does not rule out other kinds of vulnerabilities or components that were not examined.

Security and access

In Malakium Desktop, access is protected with a personal PIN. Access permissions determine which shared information someone can view or change. When we release Desktop installers, we check the digital signature and file hash. Checking installers is different from the verification performed by the updater during an update; that is being investigated separately.

Reporting vulnerabilities

We assess reports of possible vulnerabilities for validity, scope and impact. A report does not itself confirm a vulnerability. We distinguish reported, investigated, confirmed and resolved issues.

Responsible disclosure

Where needed, we work on remediation and coordinate when details can be disclosed responsibly. We publish conclusions only when the facts have been sufficiently established and the information has been approved for disclosure.

Security Research

We investigate how data is protected and how software updates and access are checked. Each topic below has its own investigation status. We publish completed findings when the facts have been verified and disclosure is authorized.

Encryption during synchronization

Investigation ongoing

We are investigating the security of data during synchronization. There is no completed conclusion that we can publish here as an established finding yet.

Software update verification

Investigation ongoing

The digital signature and file hash of Desktop installers are checked at release. The verification performed by the updater itself is being assessed separately; we will publish a conclusion when that investigation is complete.

Identity and access security

Investigation ongoing

We are assessing how account security and access permissions work in the different parts of Malakium. There is currently no completed public conclusion for this topic.