News ›
PHP “php2shell” flaws: our services do not use PHP
Two critical PHP flaws were made public on October 21, 2026. We checked our services: none of them uses PHP.
On October 21, 2026, two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) were made public. They can allow someone to take control, remotely and without authentication, of a web server that runs PHP. Their severity is rated 9.2 out of 10 (CVSS 4.0). The specialist press refers to them as “php2shell”.
We checked all of our services and servers: none of them uses PHP. To our knowledge, SouverainCode, Archipel, profAI, Luce, GenIA, Toge and our SouverainBox are therefore not exposed to these flaws, and they are running normally.
If your organization runs a PHP website or application (WordPress, for example), install the security release for your branch without delay (PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12) or ask your hosting provider for it.
Sources: PHP project announcement, and the project’s security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
SouverainCodeSouverainBoxArchipel DesktopLuceProfAIGenIAToge