Advisory summary
Status: Not affected
Products reviewed: Validatar Cloud, Validatar Server, Data Agent
Customer action required: None
Published: October 23, 2026
Validatar is not affected by PHP2Shell, the pair of critical PHP vulnerabilities disclosed on October 21, 2026. Validatar does not use PHP. There is nothing to patch, restart, or reconfigure in Validatar Cloud, Validatar Server, or the Data Agent.
About PHP2Shell
PHP2Shell is the name given to two vulnerabilities in the PHP runtime:
| CVE | Issue | Severity |
|---|---|---|
| CVE-2026-109618 | Remote code execution through out-of-memory corruption | Critical (CVSS v4.0 9.2) |
| CVE-2026-109619 | Remote code execution through stale global state | Critical (CVSS v4.0 9.2) |
Why Validatar is not affected
Validatar is built on Microsoft .NET. No Validatar component includes, installs, or calls the PHP runtime.
| Product | Uses PHP | Status |
|---|---|---|
| Validatar Cloud | No | Not affected |
| Validatar Server (Windows and Linux) | No | Not affected |
| Data Agent | No | Not affected |
What you need to do
No action is needed for Validatar.
Questions
Contact Validatar Support at support@validatar.com or through the support portal.
References
- PHP security advisory for CVE-2026-109618: GHSA-w8hw-w9fx-j79w
- PHP security advisory for CVE-2026-109619: GHSA-6wmf-4rv5-p3rp
- PHP release announcements: php.net
Revision history
| Date | Change |
|---|---|
| October 23, 2026 | Initial publication |