Obsidian Security incident

Security Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)

Resolved on October 22, 2026, affecting Security Advisory.

resolved Oct 22, 2026, 05:40 PM UTC

Security Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Published: Oct 22, 2026 Summary Obsidian Security has assessed the recently disclosed PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Our response The Obsidian platform, including its supporting infrastructure and web-based management interfaces, does not use PHP or any of the affected components. These vulnerabilities do not impact the Obsidian service, and no action is required from customers with respect to Obsidian. Our team continues to monitor for related risk from third-party applications and integrations that may use PHP. We recommend customers apply patches and follow remediation guidance from any affected vendors in their environment. Questions For questions, please contact your Obsidian account team or support via [email protected] or the Admin Portal.

Started: Oct 22, 2026, 05:40 PM UTC
Resolved: Oct 22, 2026, 05:40 PM UTC
Duration: –
Detected by Pingoru: Oct 22, 2026, 05:40 PM UTC

Affected components

Security Advisory

Update timeline

resolved Oct 22, 2026, 05:40 PM UTC

Security Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619) Published: Oct 22, 2026 Summary Obsidian Security has assessed the recently disclosed PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Our response The Obsidian platform, including its supporting infrastructure and web-based management interfaces, does not use PHP or any of the affected components. These vulnerabilities do not impact the Obsidian service, and no action is required from customers with respect to Obsidian. Our team continues to monitor for related risk from third-party applications and integrations that may use PHP. We recommend customers apply patches and follow remediation guidance from any affected vendors in their environment. Questions For questions, please contact your Obsidian account team or support via [email protected] or the Admin Portal.

Your product runs on more than Obsidian Security

Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.