PHP vulnerabilities

[TWright]

“Information Security is responding to two newly disclosed critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Both are rated CVSS 9.2 Critical and can potentially allow an unauthenticated attacker to execute code remotely within an affected PHP web environment.

For anything identified, please provide Information Security with:

• Application/service name and business owner
• Whether it is internet-facing or internal-only
• Where it is hosted
• PHP version and runtime being used
• Whether CVE-2026-109618 or CVE-2026-109619 applies
• Current patch/remediation status
• Expected completion time if remediation is still required

Any indication of attempted or successful exploitation identified during your review.”
Please let review and respond if these vulnerabilities affect our CNX applications in any way.
?

[Johnny Major]

Hi,

This doesn’t affect Valence because Valence doesn’t use PHP.

Thanks