Security Update: PHP2Shell Vulnerabilities
Published: October 22, 2026
We want to let you know that our application has been patched against the recently disclosed PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619.
What Happened?
These vulnerabilities affect PHP-based applications (70% of websites on the internet use PHP) and could allow an attacker to run unauthorized code on a vulnerable server.
As soon as the issues were disclosed on October 21, our team reviewed our environment to assess exposure. The PHP team released official patches the same evening.
What We Did
After confirming that the patches do not affect application functionality, we deployed the published patches within 24 hours and verified that they were deployed successfully across our production environment.
What This Means for You
Your data and services are protected against these vulnerabilities. You don't need to take any action.
We have found no evidence that these vulnerabilities were exploited in our environment.
We continuously monitor for new security advisories and respond quickly to protect our customers.
If you have any questions or concerns, please contact our team at support@vtiger.com.
Thank you for your trust.
Vtiger Security Team
