Security update: PHP vulnerabilities (PHP2Shell) – October 22, 2026

Update timeline

1. investigating Oct 22, 2026, 04:10 PM UTC

   This is our latest update on PHP2Shell, the name widely used for two critical security flaws in PHP (CVE-2026-109618 and CVE-2026-109619). PHP is one of the most common programming languages for web applications. Details of the flaws were made public on October 20, earlier than planned, and the PHP development team released fixes the next day on October 21st. Where things stand today • Interim protections are in place for both vulnerabilities. Last night our engineering and operations teams updated the affected PHP components and hardened their configuration. These steps cut off the known attack methods while we finish the permanent fix. • No signs of exploitation. We have seen no indication that these vulnerabilities have been used against IntelePeer systems. We are monitoring the affected systems closely, and our teams are ready to respond right away if anything suspicious appears. • Additional access controls under review. We are evaluating more restrictions on who can reach the affected systems. Before we make any change, we are checking it against customer integrations so your service isn’t disrupted. If we need anything from you, we will reach out directly. The permanent fix The permanent fix is an upgrade to the latest patched PHP release. Our development team is completing the platform changes needed to support that upgrade, and each update will be tested for compatibility and stability before deployment. We expect to share a target completion date shortly and will update you as soon as we confirm it. Pointers for your own environment • Find any systems you run that use PHP, including third-party applications and appliances. • Apply the PHP project’s October 21 fixes, or your vendors’ patches, as soon as they’re available. • Until you can patch, limit access to affected systems where you can, and watch for unusual activity. If you have questions, please contact our support team at [email protected].

2. monitoring Oct 22, 2026, 04:11 PM UTC

   A fix has been implemented and we are monitoring the results.