Authentic8 Security Advisory 20261022-1: PHP2Shell
Associated CVE IDs
CVE-2026-109618
CVE-2026-109619
Description
Authentic8 is aware of the recently disclosed remote code execution (RCE) flaws in core PHP, collectively referred to as PHP2Shell. In that regard, Authentic8 Security Engineers have completed an assessment of Authentic8’s infrastructure and confirmed that no Silo information systems are susceptible to PHP2Shell.
Our Security Engineering team has also assessed other Authentic8 infrastructure that is tangential to the Silo environment. As of October 21, 2026, at 6:19 PM PDT, all identified systems utilizing PHP have been patched.
Authentic8 continues to proactively scan and monitor its information systems and services to identify and address any potential exposure to this vulnerability.
Additionally, Authentic8 is actively engaged with its subprocessors and third-party vendors to assess potential exposure throughout its supply chain. As of October 22, 2026, no Authentic8 subprocessors have reported susceptibility to this vulnerability.
Authentic8 will continue to monitor developments related to PHP2Shell and take appropriate action as necessary to maintain the security of its systems and services.
Additional Notes
Please contact Support if you have further questions or need additional information.
Disclaimer
Because this is a developing security event, Authentic8 reserves the right to change or update this advisory at any time and expects to update it as new information becomes available. This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information in this advisory or materials linked herein is at your own risk.