Parchment incident
Instructure is aware of CVE-2026-109618 and CVE-2026-109619 (referred to as "PHP2Shell"), affecting PHP.
Resolved on October 22, 2026.
Oct 22, 02:12 UTC Resolved - We have assessed all products on this status page. Where action was needed to protect customer-facing services, the remediation is complete. This is the final update. Oct 22, 00:21 UTC Update - We are continuing to investigate this issue. Oct 21, 22:52 UTC Update - We are continuing to investigate this issue. Oct 21, 21:57 UTC Update - We are continuing to investigate this issue. Oct 21, 20:45 UTC Investigating - Instructure is aware of CVE-2026-109618 and CVE-2026-109619 (referred to as "PHP2Shell"), affecting PHP. The Canvas application does not use PHP and is not affected. We have completed an initial assessment of our other products. Where affected PHP versions are in use, we are prioritizing remediation and have implemented compensating controls and additional monitoring while that work is completed. We will update as remediation progresses.
Update timeline
- resolved Oct 22, 2026, 02:12 AM UTC
Oct 22, 02:12 UTC Resolved - We have assessed all products on this status page. Where action was needed to protect customer-facing services, the remediation is complete. This is the final update. Oct 22, 00:21 UTC Update - We are continuing to investigate this issue. Oct 21, 22:52 UTC Update - We are continuing to investigate this issue. Oct 21, 21:57 UTC Update - We are continuing to investigate this issue. Oct 21, 20:45 UTC Investigating - Instructure is aware of CVE-2026-109618 and CVE-2026-109619 (referred to as "PHP2Shell"), affecting PHP. The Canvas application does not use PHP and is not affected. We have completed an initial assessment of our other products. Where affected PHP versions are in use, we are prioritizing remediation and have implemented compensating controls and additional monitoring while that work is completed. We will update as remediation progresses.
Your product runs on more than Parchment
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services