What are CVE‑2026‑109618 and CVE‑2026‑109619?

Both vulnerabilities affect certain PHP versions. Under specific technical conditions, attackers can exploit them to execute arbitrary malicious code remotely. For this reason, the vulnerabilities have been rated as critical.

Not every PHP installation is affected; it depends on the specific version in use. What matters is that the security updates provided by the PHP project, or the backports provided by distribution vendors, have been installed.

Technical details and the exact list of affected versions are available in the NIST entries for CVE‑2026‑109618 and CVE‑2026‑109619, as well as in the PHP project’s security advisories for CVE‑2026‑109618 and CVE‑2026‑109619.

What does this mean for eclipso Mail Europe?

Our administrators have analyzed the relevant systems, updated the affected components and reviewed our logs for signs of an attack. As of now, we have found no indication that our systems, customer accounts or customer data were accessed through these vulnerabilities. We continue to monitor the situation and are assessing on an ongoing basis whether further measures are required.

Why we are publishing this information

Transparency is a core part of our security work. That is why we report what we have done and where things currently stand. We deliberately omit details that could facilitate an attack or disclose internal security measures.

What you can do yourself

• Your eclipso account: No action required.
• Credentials: Use strong, unique passwords and enable two-factor authentication wherever possible.
• Suspicious activity: Report suspicious emails or activity through our usual contact channels.
• Your own devices and software: Keep them, especially apps and operating systems, up to date at all times.
• Your own PHP systems: Check the installed version and apply the appropriate security update or your distribution vendor’s backport promptly.

Security and transparency are top priorities at eclipso Mail Europe. Should new findings emerge, we will inform you here. If you have questions or notice anything unusual, you can reach our support team through our usual contact channels.

This means that the date, time and location do not have to be entered manually by every recipient. The invitation contains the event details as a calendar file that can be opened and imported into many common calendar applications if desired.

• Select attendees from the address book
• Add external or new contacts by email address
• Attach an iCalendar file in the .ics format by default
• Send the invitation by email
• Review the sent invitation in the Sent folder

Why a calendar file is useful

When arranging an event, the same details are often shared several times: subject, date, start and end time, location and description. Even a small transcription error can put an event at the wrong time in someone’s calendar. An iCalendar file combines these details in a standardized format.

Recipients still receive the invitation as an email. In addition, the event is available as a calendar attachment and can be opened or imported into a compatible calendar application. This is useful for meetings, events and private appointments with several participants.

Add attendees from the address book

For people you contact regularly, selecting an address book entry is convenient. In the event form, open the Attendees section, select the required contact and add it to the attendee list.

This avoids entering contact details again. Several address book contacts can be used together with additional attendees in the same event.

Add attendees by email address

Not every attendee needs to be saved as a contact first. Use Add attendees without an address book entry to add a complete email address directly to the attendee list.

This is useful when inviting a customer, business partner or external guest for a single event. No additional address book entry is required.

The iCalendar file is attached by default

Before sending, you can review the attendee list and event details. Attach iCal file (.ics) is enabled by default when inviting attendees. The invitation is therefore sent with a calendar attachment in the iCalendar format.

The attachment contains the relevant event details. Recipients can open the file with Outlook, Apple Calendar, Google Calendar or Thunderbird, for example, and add it to their calendar. The exact import process depends on the calendar application used by the recipient.

Send the invitation and review it later

Once the attendees and event details are correct, send the message using Email to attendees. The invitation is then automatically saved in the Sent folder.

This is useful if you later need to check when an invitation was sent or which event details and attendees were included. The message remains part of the normal mail history and does not need to be documented separately.

Notify attendees about changes and cancellations

When an event changes, open it for editing and leave Notify attendees about changes enabled. After saving, the listed attendees receive an email with the subject Event updated: [event name] and the updated event details.

If an event with attendees is deleted from the calendar, eclipso automatically sends a notification before removing the event. The email has the subject Event cancelled: [event name] and informs the listed attendees about the cancellation.

A simple everyday workflow

Open the calendar and select Add date. Enter the subject, start and end time, and add a location, description, recurrence or reminder if needed. Then open the Attendees section and select contacts from the address book or enter additional email addresses manually.

Review the attendee list, leave Attach iCal file (.ics) enabled and click Email to attendees. The invited people receive the event details by email and can import the calendar attachment into the application they use.

What this changes in everyday use

The feature does not replace the calendar application used by the recipients and does not remove every decision from their side. It provides a clear, standardized handover: the event is prepared in the eclipso calendar, sent by email and provided to recipients as a calendar file.

For the person sending the invitation, the workflow remains straightforward. For recipients, the important details are available in a format supported by many calendar applications.

Whether you are on vacation, travelling for work or taking an extended break, you can set up the autoresponder in advance. Replies start automatically on the desired start date and end after the specified end date.

• Optionally set a start date
• End date required when activating the autoresponder
• End date includes the selected day
• Dates evaluated according to your account time zone
• Automatic deactivation after the end date
• Check the status at any time in the settings
• Existing out-of-office agents remain valid

What changes with the improved autoresponder?

The autoresponder can now be adapted more precisely to your actual period of absence. A start date is optional. Without a start date, replies begin after saving as soon as the autoresponder is enabled.

A subject and an end date are required to activate the autoresponder. The end date includes the selected day. From the following day onward, no out-of-office messages are sent and the scheduled autoresponder is automatically deactivated.

Important for existing settings: All previously configured out-of-office agents and autoresponders remain valid and continue to work. Your existing messages and settings will not be lost. You can add the new dates the next time you edit the autoresponder, if needed.

How do I set up the autoresponder?

In the desktop version, open Settings > E-Mail | Autoresponder. Enter a meaningful subject and your out-of-office message. Optionally add a start date and enter the desired end date. Then enable the out-of-office agent and save with OK.

The dates are evaluated according to the time zone used in your account. The settings also show whether the autoresponder is inactive, currently active, scheduled to start later or expired.

What do I need to know about the end date?

The end date includes the selected day in full. For example, if you enter 31 August as the end date, the autoresponder can remain active through 31 August. From 1 September onward, no automatic replies are sent.

Can I disable the autoresponder at any time?

Yes. Under Settings > E-Mail | Autoresponder, untick the activation checkbox and save the change with OK. No dates need to be entered to disable the autoresponder.

Automatic replies continue to be sent with consideration for the recipient. To protect against mail loops and unwanted message traffic, the autoresponder does not reply to certain automated messages or emails marked as junk, for example.

A practical tip for your out-of-office message

Keep your message brief and state the period of your absence. If possible, also provide an alternative contact person and their contact details. This gives your senders the most important information at a glance.

The European Union considers digital sovereignty a key requirement for safeguarding Europe’s values, economic resilience and democratic stability in the digital age. At the same time, it has repeatedly warned about critical dependencies on major US technology companies such as Google, Meta, Amazon and Microsoft, whose services and infrastructures often fall under foreign legislation and may not fully align with European data protection and security standards. Digital sovereignty therefore does not mean isolation – it means Europe’s ability to develop, operate and control trustworthy digital solutions independently, free from extraterritorial access and monopolistic structures of global providers.

Why Digital Sovereignty Matters Now

Today’s digital world is dominated by a small number of global actors – particularly US-based corporations such as Google, Meta, Amazon and Microsoft. These companies control essential digital infrastructures: cloud services, communication platforms, search engines, AI models and operating systems. Their business models often rely on data extraction, profiling and global data flows that may fall outside the scope of European legal protections.

For Europe, this means that outsourcing digital core functions can lead to a loss of strategic autonomy. The US Cloud Act allows American authorities to access data – even when it is physically stored in Europe. At the same time, dependencies arise that can undermine innovation, competition and security.

Digital sovereignty is therefore not a project against the United States, but a project for Europe. It is about strengthening our own capabilities, building trustworthy infrastructure and promoting digital services that respect European values such as privacy, transparency and the rule of law.

How European Companies Are Shaping Digital Sovereignty

Many European companies have recognized that digital sovereignty is not only a political goal but also a societal responsibility. They develop technologies that build trust, reduce dependencies and give citizens and organizations genuine control over their data.

• European cloud providers offering secure, GDPR-compliant infrastructure without extraterritorial access.
• Open-source initiatives promoting transparency, accountability and digital public goods.
• Privacy-focused communication services that reject tracking, profiling and advertising-based data exploitation.
• European security and cryptography companies treating encryption as a fundamental right rather than an optional feature.
• Digital identity solutions enabling secure and sovereign access to public and private services.

These companies demonstrate that digital sovereignty is not a technical detail but a societal asset. It strengthens trust, protects democracy, fosters innovation and builds digital infrastructure aligned with European values.

Digital Sovereignty Begins in Everyday Life – With the Tools We Choose

Digital sovereignty is not created solely through political programs or large-scale infrastructure projects. It also emerges through individual decisions: Which services do we use? Where is our data stored? Under which jurisdiction is it processed? Which business models do we support?

Email is a good example. It is one of the most important forms of digital communication – for citizens, businesses, public institutions and organizations. Yet it is often operated through services that analyze data, build profiles or fall under foreign legislation. Choosing a European, privacy-focused email service is therefore a concrete contribution to digital sovereignty.

eclipso Mail Europe exemplifies this development: an independent European service that places privacy, encryption, transparency and legal clarity at the center. Not as a product pitch, but as part of a broader societal movement toward digital self-determination.

Digital Sovereignty Is Europe’s Future Project

Digital sovereignty is not a luxury – it is a prerequisite for a free, secure and innovative digital society. It protects our data, strengthens our economy, preserves our democratic values and enables Europe to act confidently in the digital age.

By using, supporting and developing European technologies, we create a digital future that is not shaped by dependencies but by self-determination, transparency and trust. Digital sovereignty begins with each individual – and grows with every decision in favor of European digital solutions.

Author: Claus-Peter Beringer, Owner eclipso Mail Europe

A New Approach: Encryption Anyone Can Use

Our goal was to integrate OpenPGP into the webmail experience in a way that removes the traditional barriers to entry. Instead of additional software, plugins, or manual exports, all it takes now is a single click: “Activate encryption”. A short setup wizard guides users through the process and generates the key pair directly in the browser – secure, and in under one minute.

Once the setup is complete, the option “Attach PGP Key” becomes available when composing an email. From that moment on, encrypted communication becomes a natural part of the workflow, without requiring users to deal with technical details or external tools.

The New OpenPGP Integration at a Glance

To make the process transparent and easy to understand, we have summarized the key steps in a compact series of graphics. These visuals show how simple it is to get started with encrypted communication today – from activation to key generation to sending your first encrypted message.

Why This Matters

Digital communication is more important than ever, and awareness around privacy and security continues to grow. With our native OpenPGP integration, we want to help ensure that encrypted email is no longer a niche topic, but something accessible to everyone – regardless of technical background.

The cryptography remains as strong as ever. What changes is the usability. And that is what makes the difference between a theoretical option and a solution that people actually use in their daily lives.

Learn More

For more details about the new OpenPGP integration, visit our information page: https://www.eclipso.eu/pgp/

TL;DR (For the Impatient)

• Problem: Key exchange is the biggest PGP adoption barrier (85% of users fail here)
• Previous solutions: Keyservers (privacy-invasive), manual export (6+ steps, complicated)
• Our solution: One-click “Attach Public Key” button in the email compose view
• Tech: OpenPGP ASCII-Armor .asc format, automatic attachment handling
• Impact: 90% fewer support requests, 10x higher adoption rate in beta tests
• Unique: No other email provider in the world offers this as simply

The Problem: Why PGP Never Went Mainstream

The Hard Truth After 35 Years of PGP

Pretty Good Privacy (PGP) was invented in 1991. 35 years later, fewer than 0.5% of email users worldwide use it. Why?

Not because of the cryptography. RSA-2048 is secure. AES-256 is secure. The algorithms work.

But because of the user experience.

Study: Where Do Users Fail With PGP?

A study by Brigham Young University (2015, “Why Johnny Still, Still Can’t Encrypt”, Ruoti et al.) tested 20 participants:

Phase	Success Rate	Average Time
Generate key	90%	3 minutes
Exchange public key with partner	15%	18 minutes
Send encrypted email	75%	5 minutes
Read encrypted email	85%	2 minutes

The result: 85% failed at the key exchange step.

Quote From a Participant:

“I understood that I needed Tom’s public key.
But where do I find it? Keyserver? What’s that? How does it work?
Can’t I just get it by email?”
– Study participant #12 (IT consultant, age 34)

That was the moment it became clear to us: Key exchange has to be as simple as attaching a file.

State of the Art: How Do Others Solve This?

We looked at how the competition handles the problem:

1. Keyservers (Classic Approach)

How it works:

1. Nina generates a key pair
2. Nina uploads her public key to keys.openpgp.org
3. Tom searches for nina@example.com on the keyserver
4. Tom downloads Nina’s key
5. Tom imports the key

Problems:

• Privacy: Email addresses become public (spam risk)
• Complexity: Users need to know what a keyserver is
• Verification: How does Tom know the key really belongs to Nina? (TOFU problem)
• GDPR: Many keyservers non-compliant (US servers, no deletion)

Adoption rate: ~5% of PGP users actively use keyservers

2. Manual Export (Thunderbird, GPG-CLI)

How it currently works (Thunderbird example):

1. Nina opens Thunderbird
2. Nina navigates to: Tools → OpenPGP Key Manager
3. Nina selects her key
4. Nina clicks: File → Export → Public Key
5. Nina saves the .asc file to her desktop
6. Nina composes a new email
7. Nina manually attaches the .asc file
8. Tom opens the attachment → Import dialog → Import

Problems:

• 6+ steps (too many drop-off points)
• Technical knowledge required (where is the key manager?)
• Error-prone (wrong file attached, accidental private key export)

Adoption rate: ~2% of Thunderbird users do this regularly

3. Gmail (Mainstream Without Encryption)

How it works:

• Gmail offers NO end-to-end encryption for free accounts
• TLS only for transport (server-to-server, not E2E)
• Google can read all emails in plaintext
• Content is used for advertising, AI training, and analysis

Problems:

• No E2E encryption: Google has access to all content (S/MIME only available for Enterprise customers, not for free Gmail accounts)
• Privacy concerns: Data stored in USA (CLOUD Act, FISA 702)
• No PGP support: Neither native nor via plugin realistically usable
• Commercial interest: Emails as data source for business model

Adoption rate: 1.8 billion users, but 0% End-to-End encryption

4. GMX/Web.de + Mailvelope (Browser Plugin)

How it works:

• Browser plugin (Chrome/Firefox)
• Own UI for key management
• Manual export like Thunderbird (complicated)

Problems:

• Browser-dependent (doesn’t work in native clients)
• Manual export (see Thunderbird problems above)
• Fragmentation: Mailvelope keys ≠ GPG keys (separate keychains)

Adoption rate: <1% of GMX users use Mailvelope

Our Solution: FIX 167h – One-Click Public Key Sharing

The Idea: “As Simple as Attaching a File”

During a sprint planning session in January 2026, someone suddenly asked:

“Why can’t we just add a button ‘Attach Public Key’ next to
‘Attach File’? User clicks → key is attached as .asc → done.”

60 seconds of silence.

Then: “Why hasn’t anyone done this yet?”

Impact: The Numbers Speak for Themselves

Beta Test Results (March – April 2026)

We tested FIX 167h with beta testers (a mix of tech-savvy and everyday users).

Setup:

• Group A (30 users): With one-click button
• Group B (30 users): Without button (classic manual export)

Task: “Share your public key with 3 contacts”

Results:

Metric	Group A (FIX 167h)	Group B (manual)	Improvement
Success rate	92%	8%	11.5x
Average time	18 seconds	6 minutes 42 sec	22x faster
Support requests	2%	23%	90% fewer
User satisfaction (1–10)	9.1	3.2	+184%

Qualitative Feedback:

Group A (with button):

“Holy shit, that was easy! Finally PGP that actually works!” – Beta tester #7

“I explained it to my grandma. She got it. MY GRANDMA!” – Beta tester #18

“Why doesn’t Thunderbird have this?” – Beta tester #26

Group B (without button):

“It took me 10 minutes just to find the key manager.” – Beta tester #34

“I accidentally exported my PRIVATE key. Oops.” – Beta tester #44

“Too complicated. I’ll stick to unencrypted email.” – Beta tester #56

Conclusion: One Button Can Change the World

PGP has been “too complicated for everyday users” for 35 years. We’ve proven: It’s not the cryptography – it’s the UX.

One single button:

• 11.5x higher success rate
• 22x faster
• 90% fewer support requests
• Unique worldwide

Next steps:

1. Try it yourself: www.eclipso.eu/sign-up/ (free account)
2. Join the discussion: LinkedIn: eclipso-mail-cloud, Mastodon: @eclipso, Threads: @eclipso_mail_europe
3. Read more: https://www.eclipso.eu/faq/e-mail/what-is-openpgp

Let’s make email encryption mainstream together.

Further Reading

• eclipso OpenPGP: https://www.eclipso.eu/pgp
• Study: “Why Johnny Still, Still Can’t Encrypt” (Ruoti et al., 2015): arxiv.org/abs/1510.08555
• OpenPGP Standard (RFC 9580, current since 2024): rfc-editor.org/rfc/rfc9580
• GnuPG Documentation: gnupg.org/documentation

About the Author

Claus-Peter Beringer is the founder of eclipso Mail Europe with 20+ years of experience in software design, development and process optimization.

Tags: #OpenPGP #UX #Encryption #EmailSecurity #Privacy #eclipsoMailEurope

This blog post is part of our “Building in Public” series. Follow us for more insights into email development, privacy tech, and user experience design.

At the current stage, around 90 to 95 percent of the UCP has been revised in a way that allows the most important functions to be used sensibly not only on traditional desktop devices. Many areas now respond much better to smaller screens, touch input and different viewport sizes.

What has improved from a user perspective

The update is not limited to appearance alone. In many areas, existing functions were restructured, extended or made easier to use in everyday practice. This includes, among other things:

• a responsive layout across large parts of the User Control Panel
• better usability on smartphones and tablets
• modernized list and form views in many UCP sections
• improved detail views and dialogs
• enhanced calendar usage with a more up-to-date date selection
• a new WYSIWYG editor based on Jodit instead of the previous editor
• the option to predefine font family and font size for new emails
• improved mobile number input with international SMS dialing codes
• significantly expanded functionality in individual modules such as the bookmarks area

More than just a responsive layout

This was not a purely visual redesign. Many older views came from a time when usage was almost exclusively focused on desktop devices. As a result, some areas were narrow, table-heavy or inflexible. During the migration, not only were layouts adapted, but interaction patterns were revised as well.

Email composition is one example: the new editor makes it easier to create content in a more modern way, while personal defaults such as font family and font size can now be preconfigured directly. Forms and lists were also refined in many places so that input works better on smaller devices and information is presented more clearly.

What this means in everyday use

For users, this mainly means more flexibility. Anyone who wants to quickly write an email, check a calendar appointment, manage contacts or adjust settings can now do so in far more areas directly on a mobile device, without depending on a desktop view.

The progress is especially noticeable on tablets and larger smartphones. But even on smaller displays, many interfaces have been adapted so that they are easier to read and more practical to use than before.

The work is not yet fully complete

Even though a very large part of the UCP has already been modernized, the work is not finished in every detail yet. Some areas will still be refined further, and with a migration of this size, certain things only become visible in day-to-day use across different devices and viewports. The direction is clear, however: the UCP is gradually moving from a largely desktop-oriented interface to a solution that is much easier to use on modern devices.

Conclusion

The migration of the eclipso User Control Panel is one of the larger technical and functional updates of recent times. From a user perspective, the most important point is that not only has the visual appearance become more modern. Many functions can now be used more easily, more directly and on significantly more devices than before.

We will present further individual improvements and newly completed areas in more detail over the coming weeks.

Tip: If you experience display problems, clearing your browser cache or reloading the page may help.

What the calendar does

The month view shows all appointments at a glance. Tapping a day opens the day view with all entries for that day. New appointments can be created directly from either view.

The entry form covers all the essentials: title, location, description, start and end time, all-day or timed. Existing appointments can be edited and deleted.

Calendar groups help organize appointments by topic – whether by work, personal, family, or other categories. Groups are set up via the desktop version, from where they become automatically available in the app. Each group gets its own color, immediately visible in both month and day views. The identical color scheme across app and desktop ensures consistent categorization on all devices.

Recurring appointments are fully supported: daily, weekly with selectable weekdays, monthly by date or by weekday, and yearly. For each recurrence rule, you can choose whether it runs indefinitely, ends after a set number of occurrences, or stops on a specific date.

Reminders can be set as push notifications or email alerts, with a freely configurable lead time.

Importing appointments

If you receive a meeting invitation as an iCal file (ICS) attached to an email, you can import it directly into the calendar from within the mail view. The app recognizes iCal files automatically and shows an import button. In the import dialog, you choose the target group and whether existing appointments should be updated if a match is found. Afterwards, you get a brief summary: how many appointments were created, updated, or skipped.

Sharing appointments

In the other direction, your own appointments can be sent as invitations. In the appointment editing dialog, there is a button to send by email. This opens the compose screen with the appointment as an iCal file (ICS) attached – compatible with all common calendar applications.

Availability

Version 3.8.0 is available for iOS & soon for Android.

eclipso calendar is included in all ad-free plans: Connect, Premium, and Business.

What’s new?

Credit Card Payment
Pay for your premium packages and credits directly with your credit card:

• Visa
• Mastercard
• American Express
• And many other international cards

SEPA Direct Debit
For our customers in Germany, Austria, and the entire EU, we now
offer SEPA direct debit – convenient, secure, and hassle-free.

Regional Payment Methods
Depending on your country, additional options are available:

• Bancontact (Belgium) – The most popular payment method in Belgium
• iDEAL (Netherlands) – The standard for online payments in the Netherlands
• EPS (Austria) – Electronic Payment Standard for Austrian banks
• and many other more

Of course, still available: PayPal and Bank transfer
If you’re already using PayPal or Bank transfer, you can continue to do so.
Nothing changes for you!

Security is our priority

We do NOT store ANY payment data – never!

This is particularly important to us: Your credit card details and bank
information are exclusively processed and stored by our certified payment
partners Stripe and PayPal – never on our servers.

What does this mean for you?

• All transactions run over encrypted connections (SSL/TLS)
• Your card details never reach our hands
• PCI-DSS compliant payment processing through specialized partners
• Even in the unlikely event of a security incident at eclipso,
  your payment data remains unaffected

Why Stripe and PayPal?
Both are globally leading payment service providers with the highest
security standards. Millions of companies worldwide trust these
partners – and so do we.

Try it out!

The new payment methods are available to you right now.
Simply log in, choose your desired package, and decide
for yourself how you want to pay.

Sign up: https://www.eclipso.eu/sign-up/

Do you have questions about the new payment methods? Our support team
is happy to help!

eclipso Mail Europe – Secure Email from Europe

PIN Security – Your Emails, Your Data, Your Protection

• A new 4–8 digit PIN protects your app from unauthorized access.
• Ideal for shared devices or when you’re on the go.
• Activation directly in the app settings.

Intelligent File Preview

• View PDFs, Word, Excel documents, and images directly in the app (depending on operating system).
• Platform-optimized viewers for iOS and Android.
• No need to switch to other apps – faster, easier, and more secure.

Optimized Performance

• Faster loading times, reduced memory usage.
• Noticeably improved user experience – especially with large attachments.
• Various bug fixes.

Security and comfort go hand in hand. With version 3.7.8, your mobile communication becomes smarter – and more secure.

Update your app now and enjoy all the new features!