Couchdrop incident
Security Advisory: Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) - Not Affected
Resolved on October 22, 2026, affecting API and Movebot Admin and 1 more.
Security Advisory: Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) Status: Not Affected On 21 October 2026, the PHP Security Team disclosed two critical vulnerabilities affecting the PHP runtime, identified as CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Both vulnerabilities carry a CVSS v4.0 severity score of 9.2 (Critical) and could allow unauthenticated attackers to execute arbitrary code on vulnerable servers. Impact on Couchdrop and Movebot We can confirm that neither Couchdrop nor Movebot is affected by these vulnerabilities. Neither platform uses PHP in any of its application components or underlying platform infrastructure. Consequently, these vulnerabilities do not present an exposure to either platform. Couchdrop: Not affected. Movebot: Not affected. Customer Data: No identified exposure resulting from these vulnerabilities. Service Availability: No impact. Customer Action Required: None. We continue to monitor emerging security threats and vulnerabilities as part of our ongoing security management processes.
Affected components
Update timeline
- resolved Oct 22, 2026, 06:35 PM UTC
Security Advisory: Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) Status: Not Affected On 21 October 2026, the PHP Security Team disclosed two critical vulnerabilities affecting the PHP runtime, identified as CVE-2026-109618 and CVE-2026-109619, collectively referred to as PHP2Shell. Both vulnerabilities carry a CVSS v4.0 severity score of 9.2 (Critical) and could allow unauthenticated attackers to execute arbitrary code on vulnerable servers. Impact on Couchdrop and Movebot We can confirm that neither Couchdrop nor Movebot is affected by these vulnerabilities. Neither platform uses PHP in any of its application components or underlying platform infrastructure. Consequently, these vulnerabilities do not present an exposure to either platform. Couchdrop: Not affected. Movebot: Not affected. Customer Data: No identified exposure resulting from these vulnerabilities. Service Availability: No impact. Customer Action Required: None. We continue to monitor emerging security threats and vulnerabilities as part of our ongoing security management processes.
Your product runs on more than Couchdrop
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services