Anomali is aware of two vulnerabilities in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, together known as "PHP2Shell." Details became public on October 20, 2026, and the PHP project released fixed versions on October 21, 2026. Both vulnerabilities are rated Critical and can allow unauthenticated remote code execution on servers running affected versions of PHP.

Our assessment

‍Anomali began a formal, cross-functional review following disclosure. Based on our review to date, we have not identified exposure to these vulnerabilities in Anomali products or services, and we are not aware of any action customers need to take for Anomali products.

If our assessment changes

‍If we determine that customer data or services are affected, we will notify affected customers through their designated contacts, in accordance with our agreements with them and applicable law.

Questions

‍Please contact your Anomali technical account manager or contact us at security@anomali.com.

This statement reflects information available as of the date above and may be updated as our review continues. It is provided for informational purposes only and does not modify or amend any agreement between Anomali and its customers.