[Security] PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619): Snowplow is not affected

[23-Oct-2026]

Two critical vulnerabilities in the PHP runtime, known as PHP2Shell, were disclosed this week: CVE-2026-109618 and CVE-2026-109619. Both allow an unauthenticated attacker to execute code on affected PHP workers. PHP released fixed versions on 21 October 2026 (PHP announcement).

We have had questions from several customers, so this notice sets out our position.

Is Snowplow affected?

No. Snowplow does not use PHP anywhere in its pipeline, collector, Console or supporting services. We have confirmed this with a scan of our estate: there are no PHP runtimes or PHP packages, and no findings for either CVE.

What about the Snowplow PHP tracker?

The PHP tracker is a library that runs inside your own PHP installation. It does not contain the vulnerable code itself, but the PHP runtime it runs on may.

If you use the PHP tracker, or run PHP anywhere else, you should:

• Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later).

• Restart all PHP workers (php-fpm, mod_php, CGI) so the fix takes effect.

• Move off end-of-life PHP versions. End-of-life PHP branches are not expected to receive fixes, so those installations should be moved to a supported version.

No changes to the tracker itself are required.

Questions

If you have any questions, or your security team needs a formal response for a supplier assessment, please raise a ticket with Snowplow Support and reference this notice.