Echo360 incident
Echo360 Status - PHP Vulnerabilities (CVE-2026-109618 / CVE-2026-109619)
Resolved on October 22, 2026, affecting EchoVideo - US and EchoVideo - US (EchoVideo - US — Access) and 1 more.
PHP has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (reported as "PHP2Shell"). Echo360 has reviewed both issues and has completed patching across all Echo360-hosted environments, including our customer-facing applications and websites. No action is required for Echo360 customers, and no update to Echo360 LMS integrations or plugins is needed. Customers who self-host an LMS such as Moodle should apply the PHP update provided by their LMS or hosting vendor.
Affected components
Update timeline
- resolved Oct 22, 2026, 02:06 PM UTC
PHP has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (reported as "PHP2Shell"). Echo360 has reviewed both issues and has completed patching across all Echo360-hosted environments, including our customer-facing applications and websites. No action is required for Echo360 customers, and no update to Echo360 LMS integrations or plugins is needed. Customers who self-host an LMS such as Moodle should apply the PHP update provided by their LMS or hosting vendor.
Your product runs on more than Echo360
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services