PHP2Shell vulnerability: The security issue is fully mitigated across all systems

PHP2Shell is the name given by the security community to two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). Exploiting these vulnerabilities allows an attacker to execute arbitrary commands on a server. As scheduled, the PHP security team released the official patches for CVE-2026-109618 and CVE-2026-109619 at 14:00 UTC (16:00 CEST) on Wednesday, the 21st of October 2026.

Our engineers applied the updates as soon as the patch was released, coordinating updates across all production and integration environments. Health checks were performed to confirm that services remained operational. We aimed to keep the interruption to a minimum throughout the process.

The patched PHP packages were installed on every server in our infrastructure. After deployment, we verified that all services resumed normal operation and that the newest PHP packages were in use.

By closing the PHP2Shell gap promptly, our engineers have reaffirmed that we take security seriously and secure our infrastructure and the data of our customers against emerging threats.