Security notice: PHP vulnerabilities "PHP2Shell" (CVE-2026-109618 / CVE-2026-109619)

On 21 October 2026, the PHP project published fixes for two critical vulnerabilities in the PHP language, rated CVSS v4 9.2. They allow a remote attacker without an account to run code on a server running an affected PHP version. Tradeshift has assessed its exposure to these vulnerabilities.

Impact on Tradeshift

The core Tradeshift platform and APIs do not run on PHP. A small number of supporting web applications, including our customer portal, use PHP. Our security team began monitoring for exploitation on the morning of 21 October, before the fix was published, and the same day upgraded the affected production applications to the patched PHP release and applied the additional hardening recommended by the PHP project.

We have contacted the relevant third-party providers to confirm the status of their services and will update this notice once we receive their answers.

Exploitation status

Our investigation has found no evidence that any exploitation attempt succeeded or that customer data was accessed.

Customer action

No action is required from Tradeshift customers. If you run PHP in your own systems, we recommend upgrading to a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35). PHP 8.1 and older will not receive an official fix.

Timeline

• 21 Oct 2026: PHP security release published. Monitoring in place from the morning. Affected supporting applications upgraded to the patched release the same day.

• 22 Oct 2026: Third-party provider confirmations requested. Notice published.