PHP2Shell vulnerabilities (industry-wide)

Incident

PHP2Shell vulnerabilities (industry-wide)

Status: in progress
Start:
Affected Components:
Investigating

Description: On October 21, 2026, security researchers disclosed two critical remote code execution vulnerabilities in core PHP memory-handling routines, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The vulnerabilities affect servers running vulnerable PHP runtimes.

As of this update, Collibra Security and Engineering have not identified any impact to Collibra products, hosted services, or customer data. Collibra’s platform and customer-facing application infrastructure do not run on PHP. We continue to assess our environments and third-party vendors, and we will provide updates accordingly.


Incident #
PHP2Shell
Deployment
All