---
title: "PHP2Shell (CVE-2026-109618, CVE-2026-109619): Validatar Not Affected"
slug: "php2shell-cve-2026-109618-cve-2026-109619"
updated: 2026-10-23T18:19:27Z
published: 2026-10-23T18:19:27Z
canonical: "docs.validatar.com/php2shell-cve-2026-109618-cve-2026-109619"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.validatar.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PHP2Shell (CVE-2026-109618, CVE-2026-109619): Validatar Not Affected

Advisory summary

              

**Status:** Not affected **Products reviewed:** Validatar Cloud, Validatar Server, Data Agent **Customer action required:** None **Published:** October 23, 2026

Validatar is not affected by PHP2Shell, the pair of critical PHP vulnerabilities disclosed on October 21, 2026. Validatar does not use PHP. There is nothing to patch, restart, or reconfigure in Validatar Cloud, Validatar Server, or the Data Agent.

## About PHP2Shell

PHP2Shell is the name given to two vulnerabilities in the PHP runtime:

| CVE | Issue | Severity |
| --- | --- | --- |
| CVE-2026-109618 | Remote code execution through out-of-memory corruption | Critical (CVSS v4.0 9.2) |
| CVE-2026-109619 | Remote code execution through stale global state | Critical (CVSS v4.0 9.2) |

## Why Validatar is not affected

Validatar is built on Microsoft .NET. No Validatar component includes, installs, or calls the PHP runtime.

| Product | Uses PHP | Status |
| --- | --- | --- |
| Validatar Cloud | No | Not affected |
| Validatar Server (Windows and Linux) | No | Not affected |
| Data Agent | No | Not affected |

## What you need to do

No action is needed for Validatar.

## Questions

Contact Validatar Support at [support@validatar.com](mailto:support@validatar.com) or through the [support portal](https://validatar.com/support).

## References

- PHP security advisory for CVE-2026-109618: [GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
- PHP security advisory for CVE-2026-109619: [GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
- PHP release announcements: [php.net](https://www.php.net/)

## Revision history

| Date | Change |
| --- | --- |
| October 23, 2026 | Initial publication |