On October 21, 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and the Canadian Centre for Cyber Security issued Alert AL26-026 the same day. Researchers at Wiz, who found the flaws, call them PHP2Shell. Successful exploitation can let an unauthenticated attacker execute arbitrary code on a server running an affected version of PHP.
PHP sits underneath a large share of the web, so customers, partners and the public have asked a reasonable question: does this affect DataStealth?
The short answer is no.
We have audited our systems, PHP is not used in our production environment, and no action is required from customers. The rest of this post explains what we checked and what we found.
What the vulnerabilities are
Both flaws are use-after-free bugs (CWE-416) in PHP's core engine. The PHP project's advisory rates each at CVSS v4.0 9.2, urges all users to update immediately, and states that no complete mitigations exist. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Deployments using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all in scope, and PHP assesses mod_php as the highest risk because an unauthenticated request can trigger the flaw before any application code runs.
The Cyber Centre notes that a proof of concept is publicly available. At the time of its alert it had not identified active exploitation, and it cautions that this can change quickly. Its guidance is to patch internet-facing systems first, identify third-party products that bundle PHP, and review logs for signs of compromise.
What we audited
When the advisory was published, our infrastructure and IT teams reviewed three areas for any use of PHP:
- Software supply chain. The third-party software and components that our products and operations depend on. None of it uses PHP.
- Managed hosting environment. The infrastructure that runs the DataStealth platform for our customers. None of it uses PHP.
- Peripheral technologies. Supporting systems outside the platform and hosting environment. Here we found one system that uses PHP.
The one system we found, and what we did
The single peripheral technology running PHP operates inside our corporate intranet, in an isolated network segment that supports our systems monitoring operations. This secondary system functions completely outside the DataStealth platform, serving strictly as a read-only portal for monitoring our managed hosting infrastructure.
Our teams applied the interim mitigations published by the PHP project to that system, then updated it to the latest patched PHP release. It is now running a fixed version.
Our production environment does not use PHP. The one internal system that did has been mitigated and patched.
What this means for customers and partners
- Our main website, datastealth.io, does not run on PHP.
- The DataStealth platform, our software supply chain and our managed hosting environment do not use PHP.
- Interactions with us through our public channels, including the customer support portal and the partner portal, remain secure.
- No action is required from customers.
To be clear about scope
This post covers DataStealth's own systems. It says nothing about your environment. If your organization runs PHP, directly or inside a third-party product, appliance or container, follow the Cyber Centre's recommended actions and check the list of affected software maintained by NCSC-NL. Note also that PHP 8.1 and older no longer receive upstream fixes, and the PHP project says PHP 8.2 reaches end of life on December 31, 2026.
We are still watching
The response to PHP2Shell is still unfolding, and further PHP releases are possible as the fixes are tested in the field. Our infrastructure and IT teams are monitoring the PHP release channels and will apply any new updates as they are published. If anything changes that affects customers, we will update this post.
This is the same discipline we apply across our security program, which we described in our post on strengthening our posture ahead of SOC 2 Type II. Details of our controls are available in the DataStealth Trust Center.
Questions about this advisory? Our team is happy to walk you through what we checked and how we monitor for issues like this.
As CEO, Jim is responsible for building upon the customer success and market, leading the day to day operations for DataStealth worldwide.
Connect on LinkedIn →