Security advisory
PHP remote code execution vulnerabilities (php2shell, CVE-2026-109618 and CVE-2026-109619)
Status: Not affected. Nimble's customer-facing products and services do not run PHP. One internal business system that uses PHP has been updated to a patched release.
Summary
On October 21, 2026, two critical remote code execution vulnerabilities in the PHP language runtime were disclosed (CVE-2026-109618 and CVE-2026-109619, also called "php2shell"). The Canadian Centre for Cyber Security issued Alert AL26-026 the same day. Exploit code is public and early attacks have been reported.
Status: Not affected
- Customer-facing products and services: nimble.ca, SmartCloud, NimbleSign and the Nimble Intelligence APIs do not use PHP and are not affected.
- Internal systems: one internal business application that runs on PHP was updated to a patched PHP release, and a follow-up audit found no other PHP exposure.
What customers need to do
No action is required for Nimble products and services.
If your own organization runs PHP, upgrading is the only effective fix: PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or your operating system vendor's patched package. PHP 8.1 and older are end-of-life and will not receive a fix.
References
- Canadian Centre for Cyber Security, Alert AL26-026, Critical vulnerabilities impacting PHP: cyber.gc.ca alerts and advisories
- Tenable, php2shell frequently asked questions: tenable.com
Questions about this advisory? Contact security@nimble.ca.
Back to the Trust Center