Ongoing since 09:44 AM UTC.
We’re aware of the two critical PHP vulnerabilities disclosed this week, CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”. The Shorthand platform is not affected. Our editor, API, story hosting and publishing infrastructure don’t use PHP. No action is needed for stories published on Shorthand or hosted through Shorthand. If you use WordPress or Drupal: our plugin runs on your own server, which uses PHP. The plugin itself doesn’t introduce these vulnerabilities, but your server’s PHP version may be affected. Please check with your hosting provider or IT team to make sure your servers are running a patched PHP release. We’ll continue to monitor this and update this notice if anything changes. If you have any questions, please contact our support team at [email protected]
Update timeline
- monitoring Oct 26, 2026, 09:44 AM UTC
We’re aware of the two critical PHP vulnerabilities disclosed this week, CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”. The Shorthand platform is not affected. Our editor, API, story hosting and publishing infrastructure don’t use PHP. No action is needed for stories published on Shorthand or hosted through Shorthand. If you use WordPress or Drupal: our plugin runs on your own server, which uses PHP. The plugin itself doesn’t introduce these vulnerabilities, but your server’s PHP version may be affected. Please check with your hosting provider or IT team to make sure your servers are running a patched PHP release. We’ll continue to monitor this and update this notice if anything changes. If you have any questions, please contact our support team at [email protected]
Your product runs on more than Shorthand
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services