Heads up for PHP users:
If you send with Postmark using our PHP library or WordPress plugin, the PHP project released fixes for PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
These are critical remote code execution vulnerabilities in PHP itself, and every PHP version from the last decade is affected. Nothing in Postmark’s library or plugin causes this issue, but any server running an unpatched version of PHP is at risk.
To fix it, upgrade to the patched release for your version:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
PHP 8.1 and older no longer get updates from the PHP project.
If you’re on one of those versions, check with your vendor about backported fixes, or upgrade to a supported version.
For full details, see the official PHP security advisory: https://t.co/0xMAO1zdVU
Super duper thanks to @postmarkapp for sponsoring our work ❤️
I've used Postmark for all my transactional emails for as long as i can remember
So nice to shill something you're already a loyal customer of 👊
[Underway] Scheduled maintenance: brief data service restart: The scheduled maintenance is now underway. We'll keep you updated on our progress. https://t.co/mCNew4WSQT
[Scheduled] Scheduled maintenance: brief data service restart: 6 Oct 21:00 EDT Expected duration: About 15 minutes, up to 20
We're restarting part of our data infrast... https://t.co/mCNew4WSQT
Our support team can work with you to confirm this, but it is likely that the IP address this request came from has previously been associated with malicious activity. Here are a few common practices that may be helpful in this case:
Add retry with exponential backoff on any 403 whose response body isn't JSON — that signature identifies an edge block rather than a Postmark API error. (Max 2–4 retries)
Establish a dedicated static egress for all outbound application traffic to ensure a predictable network identity. Moving away from shared dynamic IP allocations isolates your service's reputation and prevents third-party security edge blocks.
[Resolved] Delayed Inbound Message Processing: This has been resolved. All inbound webhooks processing have been caught up. No messages have been lost. https://t.co/qc3pihDwx2
[Resolved] Delayed Message Delivery: This incident has been resolved. The backlog of messages queued during the delay between 9:49 AM and 10:07 AM CT (10:49–11:07 AM ET) has been fully processe... https://t.co/gyLKxg1uf5
[Recovering] Delayed Inbound Message Processing: We've applied a fix and inbound message processing is now recovering. Delayed messages are being worked through, and processing times ... https://t.co/qc3pihDwx2
[Investigating] Delayed Inbound Message Processing: We are currently investigating reports of delayed inbound message delays as of 10:25 CDT. Messages are being queued and will be pro... https://t.co/qc3pihDwx2
[Recovering] Delayed Message Delivery: We've identified and resolved the underlying issue that caused the delay in outbound message sending between 9:49 AM and 10:07 AM CT. New messages since 1... https://t.co/gyLKxg1uf5
[Identified] Delayed Message Delivery: We identified an issue between 9:49 AM and 10:07 AM CT that caused delays in outbound message sending. Messages were queued and are not lost. We are activ... https://t.co/gyLKxg1uf5