On 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, widely referred to as PHP2Shell. Together they allow an attacker to run code on a web server running PHP without needing to log in, and attacks have already been reported.
We know many of our customers will have seen the news, so we want to be clear.
Wizard Application is not affected
Wizard Application does not use PHP. The application, its API, our website and the infrastructure that runs them are built on a different technology, so there is no PHP code or PHP server for these vulnerabilities to reach.
Your workspace and your data are not affected, and there is nothing you need to do in Wizard Application.
What we checked
When the vulnerabilities were announced, we reviewed every part of Wizard Application, including our application code, website, server images, build pipelines and infrastructure configuration, and confirmed that PHP is not present in any of them.
What PHP2Shell is
PHP is a programming language used to run a large share of the world's websites, including many content management systems, online shops and plugins. The two flaws are in the way PHP handles the data in incoming web requests. Because they can be triggered by an ordinary web request, any website or application running an unpatched version of PHP is potentially at risk.
The PHP project has fixed both issues in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions of PHP that are no longer supported do not receive an official update.
If you run PHP yourself
Although Wizard Application is not affected, your business may use other websites or tools that run on PHP, such as a website hosted elsewhere, an online shop or an internal tool.
- Ask your web host or developer whether your website runs PHP and, if it does, whether it has been updated to a fixed version.
- Update straight away if you manage a PHP server yourself, using the fixed versions above or the updates from your operating system or hosting provider.
- Take unpatched servers offline if you cannot update them. CISA, the US cyber security agency, advises taking PHP systems offline until they are patched.
- Check your other suppliers. If a tool you rely on runs PHP, ask them whether they have patched it.
How we approach security
Security is built into how we run Wizard Application. We hold Cyber Essentials certification, which includes keeping our software up to date with security fixes. You can read more on our security page.
If you have any questions about this announcement or the security of your workspace, please contact our team.
