Impact of PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619

Background

PHP is a widely used server-side scripting language designed for web development.

PHP versions from 5.4.0 onwards have two critical security vulnerabilities collectively referred to as PHP2Shell which allow remote code execution:

The vulnerabilities are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are no longer supported and will not receive fixes.

Desktop apps

None of our desktop software on Mac or Windows uses PHP, so is not affected by CVE-2026-109618 or CVE-2026-109619.

OnDemand web app

None of our web apps use PHP, so are not affected by CVE-2026-109618 or CVE-2026-109619.

Infrastructure

None of our core infrastructure uses PHP, so is not affected by CVE-2026-109618 or CVE-2026-109619.

Other services

Assessment of PHP use by third party suppliers for services like accounting is ongoing.

Note: This information was correct at the time of publication, but this is still an evolving situation, and this page will be updated as new information becomes available.

Applies to: All products

Last reviewed: October 21, 2026