Security update: PHP2Shell vulnerabilities

On 21 October 2026, two critical security vulnerabilities affecting PHP were publicly disclosed, commonly referred to as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities could allow attackers to compromise affected web servers.

The Logwise platform does not use PHP and is therefore not directly affected by these vulnerabilities. Customer data within the Logwise platform is not exposed to PHP2Shell.

PHP is used on certain Logwise public websites, which are separate from the platform and do not host customer data managed through the Logwise service.

Logwise has taken the following measures to address the vulnerabilities:

• Security updates: All affected PHP versions used by Logwise were updated as soon as the security patches became available.
• Proactive mitigation: Our hosting provider implemented precautionary security measures before the patches were publicly released.
• Web Application Firewall (WAF): Logwise uses Cloudflare’s WAF to provide an additional layer of protection across its publicly accessible websites. Cloudflare deployed specific protections against PHP2Shell approximately nine hours before public disclosure of the vulnerabilities.

No action is required from customers in relation to their use of the Logwise platform.

This update is provided to ensure transparency regarding the vulnerabilities and the measures Logwise has taken to address them. We continue to monitor the situation as part of our ongoing commitment to protecting the confidentiality, integrity and availability of customer information.

Further information:

PHP official security advisory