Security Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Last updateresolvedOct 22 · 17:40 UTC
Security Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Published: Oct 22, 2026 Summary Obsidian Security has assessed the recently disclosed PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Our response The Obsidian platform, including its supporting infrastructure and web-based management interfaces, does not use PHP or any of the affected components. These vulnerabilities do not impact the Obsidian service, and no action is required from customers with respect to Obsidian. Our team continues to monitor for related risk from third-party applications and integrations that may use PHP. We recommend customers apply patches and follow remediation guidance from any affected vendors in their environment. Questions For questions, please contact your Obsidian account team or support via support@obsidiansecurity.com or the Admin Portal.
Reported by Obsidian Security on their status page.
