We want to update you on PHP2Shell, the critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 in PHP that have been in the news this week. We became aware of the vulnerabilities early yesterday morning and tracked them closely through Amazon Linux’s public security channels. Amazon released the fixed PHP packages first thing this morning, and we patched our servers immediately.
What we’ve done: Updated PHP on all of our servers to the patched version this morning. Applied temporary security settings to block the known attack methods while we waited for the official fix. Reviewed server logs and site analytics and found no signs of unauthorized access. Confirmed through our file integrity monitoring, which continuously tracks changes to server files, that no unexpected files were added or modified.
What you need to do: Nothing. Your data is protected and secured as normal. This vulnerability was in PHP itself, the software that runs many websites across the Internet. That’s why it affected so many sites worldwide, and why we treated it as urgent.