Tanium Security Statement Regarding PHP2Shell Vulnerabilities

October 23, 2026

What happened?

On October 21, 2026, two unauthenticated remote code execution vulnerabilities impacting PHP were published (CVE-2026-109618 and CVE-2026-109619, together known as “PHP2Shell”).

Are Tanium products and services affected?

Tanium reviewed the Software Bill of Materials (SBOM) for its supported software, including the components deployed in Tanium Cloud and Tanium Cloud USG. Tanium has not identified any Tanium product or service that is exploitable by these vulnerabilities.

What are we doing?

Tanium is tracking the PHP project’s advisories and the security bulletins of its infrastructure and cloud service providers (CSP). We have not been notified by any CSP of any impact to Tanium.

Tanium will continue to monitor developments related to these vulnerabilities and any change to the conclusion above, or to the security of customer data and systems, will be published here.

Assessing your own environment

PHP may be present on your own servers and endpoints, including inside third-party applications that bundle it. Fixes come from PHP or from the vendor of the application. Tanium has published content to help you locate instances of the PHP vulnerabilities; see https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619 for current guidance.

For more information

If you have any questions or concerns, contact Tanium Global Support.