PHP Vulnerability Responses by Company

Nylas, Inc.

Global cloud / infrastructure
Aliases / services
Nylas / Nylas API / nylas.com / Nylas, Inc.
Official website
https://www.nylas.com/
Sources identifying the operating company

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Nylas API and customer-data services

Response status
No PHP; unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Email and calendar integration APIs.

The 23 October notice says API/customer-data services use no PHP. The separate marketing website was patched to 8.5.12; supplier review continues.

Scope: API/customer-data scope is separate from marketing and external suppliers.

What users should do

No customer action required; contact security@nylas.com for questions.

Official service URL

Source URLs

  1. PHP2Shell investigation findingshttps://www.nylas.com/blog/nylas-php2shell-cve-2026-109618-cve-2026-109619/Response evidence
  2. https://www.nylas.com/blog/https://www.nylas.com/blog/Service and operation documentation
  3. https://status-v3.nylas.com/https://status-v3.nylas.com/Service and operation documentation
  4. https://trust.nylas.com/publichttps://trust.nylas.com/publicService and operation documentation
  5. https://www.nylas.com/legal/terms/https://www.nylas.com/legal/terms/Service and operation documentation
Related official sources
  1. PHP2Shell investigation findingsOfficial notice

Comments