PHP security vulnerability (PHP2Shell): Definitiv statement
On 21 October 2026, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell.
Definitiv does not use PHP and is not affected by these vulnerabilities. No action is required from Definitiv customers in relation to them.