On October 21, 2026, two critical vulnerabilities affecting PHP, publicly referred to as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619), were disclosed. When chained together, these vulnerabilities could allow unauthenticated remote code execution on servers running PHP.
Our teams responded as follows (all times UTC):
October 21, 09:00 – Mitigation measures were applied across our infrastructure to block the known exploitation vector.
October 21, 14:00 – As soon as the PHP project published its security releases, we began upgrading our environments to the latest patched PHP versions.
October 21, 15:00 – The upgrade was completed on all internet-facing environments.
Our internal environments are not exposed to this vulnerability and are also being upgraded.
Our security investigation has found no evidence that these vulnerabilities were exploited on our systems. We continue to closely monitor our infrastructure.
No action is required on your side. If you have any questions, please contact our support team.
