*Component: Common Vulnerabilities and Exposures Lookatme has completed a full review and mitigation of the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 across all Lookatme environments. All Lookatme services remain available and secure.
*Lookatme7 The Lookatme7 DAM platform runs entirely without PHP. Lookatme7 sites sit outside the scope of these vulnerabilities.
*Lookatme6 The Lookatme6 core web application runs on PHP 5.3.3, which predates the affected range (PHP 5.4 and later). Two supporting Lookatme6 servers within the affected range – authentication and media ingestion – have been patched and restarted. Clients using single sign-on through the Lookatme6 authentication service will move to Lookatme7 as a priority. Lookatme will contact each of these clients directly. Lookatme6 stage and test environments are now restricted to Lookatme network addresses.
*Drupal servers Lookatme runs Drupal servers solely for client integration testing and staging. Client production sites run independently of these servers. The Lookatme servers have been patched, then restricted to Lookatme network addresses or stopped. Lookatme legacy website pages and Lookatme UK corporate website run on separate Drupal servers, independent of the Lookatme DAM service. These servers have been patched and restarted.
Lookatme continues to monitor PHP security advisories and will post any further updates here. For questions, please contact support@lookatmedam.com.