Security Bulletin: response to PHP "PHP2Shell"

Published: October 22, 2026

Applies To: On-Premise & Private Cloud Deployments

Overview

Our Security and Engineering teams have reviewed the high-severity PHP remote code execution vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619, also known as "PHP2Shell").

Platform Impact Assessment

  • Zero PHP Usage: None of our core platform services, private cloud solutions, or on-premise software packages utilize PHP.

  • No Software Exposure: Because PHP is not included in our application stack or deployment packages, your deployed software instances are not exposed to these vulnerabilities.

Our Security Response

To ensure end-to-end security across our organization:

  • Infrastructure Audit: We completed an immediate review of our source code repositories, build pipelines, and public web assets.

  • Peripheral Services Mitigated: Limited PHP usage was identified strictly within non-core peripheral services (such as public marketing sites). All affected assets were immediately patched to fixed PHP versions or mitigated, with no signs of attempted exploitation detected.

We have no evidence or indication that any customer systems or data were impacted.

Support

If you have any questions regarding your specific deployment architecture or security boundary, please reach out to your Account Manager or Support representative.



Was this article helpful?