PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 (PHP2Shell)
security update
Admin panel
Call and video
Ticket operations
Email services
Patched in 2 hours and 48 minutes
disclosed
Fix released upstream
monitoring
T+0:15
Attack monitoring live
mitigation
T+1:18
Mitigation in place
patching
T+0:15
Rollout started
patched
T+2:48
All systems patched
Patch progress by system
CRM & MyAccount
Helper apps
LiveAgent
Awaiting patch
Mitigation in place
Patched
disclosed
Patched PHP versions fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) were released.
· T+0:00
monitoring
We analysed the vulnerabilities and started monitoring our infrastructure for attack attempts.
· T+0:15
patching
We started building our own images with the fixed PHP release instead of waiting for the official ones.
· T+0:15
mitigation
A mitigation is in place for LiveAgent until the full patch is deployed.
· T+1:18
patching
CRM and MyAccount are patched.
· T+1:45
patching
All helper apps are patched.
· T+2:00
patched
LiveAgent is patched. All systems now run the fixed PHP release. There was no downtime and no indication of exploitation. No customer action is required.
· T+2:48