Skip to content
  • There are no suggestions because the search field is empty.

Security Advisory: PHP2Shell, CVE-2026-109618 and CVE-2026-109619 (No Action Required)

AtScale isn't affected by PHP2Shell, a set of critical remote code execution vulnerabilities in PHP, because AtScale software doesn't use PHP.

Important details

  • Security Advisory: CVE-2026-109618, CVE-2026-109619 (PHP2Shell)

  • Severity: Critical (CVSS up to 9.2)

  • Affected: The PHP runtime, nearly all versions back to PHP 5.4

  • AtScale status: Not affected. No action required.

Summary

On October 21, 2026, the PHP project released fixes for PHP2Shell. The vulnerabilities let an unauthenticated attacker run code on any server running an unpatched version of PHP, whatever the application on top. See the Wiz Research write-up for details.

AtScale impact

AtScale products aren't written in PHP, and they don't include a PHP runtime. That covers the AtScale platform, AtScale Container releases, and the AtScale Installer. You don't need to patch, upgrade, or reconfigure AtScale for this issue. If you run PHP applications elsewhere in your environment, upgrade them to a patched PHP release.

Questions

If you have questions about this advisory, contact support.