Security Advisory: Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) - Not Affected
Last updateresolvedOct 22 · 18:35 UTC
Security Advisory: Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) Status: Not Affected On 21 October 2026, the PHP Security Team disclosed two critical vulnerabilities affecting the PHP runtime, identified as CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Both vulnerabilities carry a CVSS v4.0 severity score of 9.2 (Critical) and could allow unauthenticated attackers to execute arbitrary code on vulnerable servers. Impact on Couchdrop and Movebot We can confirm that neither Couchdrop nor Movebot is affected by these vulnerabilities. Neither platform uses PHP in any of its application components or underlying platform infrastructure. Consequently, these vulnerabilities do not present an exposure to either platform. Couchdrop: Not affected. Movebot: Not affected. Customer Data: No identified exposure resulting from these vulnerabilities. Service Availability: No impact. Customer Action Required: None. We continue to monitor emerging security threats and vulnerabilities as part of our ongoing security management processes.
Reported by Couchdrop on their status page.