Shipixy does not use PHP as its application technology, so the October 2026 PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) do not apply to the Shipixy application runtime.
The PHP security alert has raised questions about the safety of online services. This notice explains what happened, what it means for Shipixy, and what to do if your own organization runs PHP.
What is the PHP2Shell vulnerability?
PHP2Shell is the name for two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619 (CVE, Common Vulnerabilities and Exposures, is the public catalog of known security flaws). PHP released fixed versions on October 21, 2026.
The vulnerabilities can allow an unauthenticated attacker to execute code remotely on affected systems. The PHP team rated them 9.2 (critical) under CVSS v4.0, and security researchers have reported exploitation attempts in the wild. On October 26, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, which lists flaws that attackers are actively using.
The incident is a reminder that software security depends on knowing the components used to build and operate a digital service.
Does Shipixy use PHP?
No. Shipixy does not use PHP as its application technology.
Because the PHP2Shell vulnerabilities affect the PHP runtime, these particular vulnerabilities do not directly apply to the Shipixy application runtime.
This clarification is specific to the vulnerabilities described in the advisories. It does not mean that every part of a digital service or its supporting infrastructure is automatically protected from all cybersecurity risks.
Why does digital reliability matter for a shipping service?
Customers expect a shipping service to give them a practical, dependable way to manage their shipments.
Behind an online shipping experience are software applications, supporting infrastructure, integrations and operational processes. Each one plays a role in the overall reliability of the service. Technology choices matter, but responsible maintenance and security practices matter just as much.
How does Shipixy approach technology and security?
Shipixy uses a different application technology stack from PHP-based platforms. We take a responsible approach to security, which includes recognizing that application software, infrastructure, third-party components and integrations can each have different security requirements.
Our focus is the ongoing improvement of the digital services behind the Shipixy customer experience.
What should users of PHP-based services do?
If your organization runs a PHP-based website or application, take these steps:
- Identify every PHP installation and check the version in use.
- Review the official PHP security advisory for CVE-2026-109618 and CVE-2026-109619.
- Update to a fixed release: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (as of November 2026). Older branches remain affected, and the PHP team says updating is the only safe option.
- Check third-party applications and software packages that may include PHP.
- Follow official guidance on monitoring and incident response.
Do not assume a system is free of PHP just because its main application uses another technology. Supporting components and third-party products count too.
Frequently asked questions
Is Shipixy affected by the PHP2Shell vulnerability?
The PHP runtime vulnerabilities CVE-2026-109618 and CVE-2026-109619 do not directly apply to the Shipixy application runtime, because Shipixy does not use PHP as its application technology.
Is a platform safer simply because it does not use PHP?
Not necessarily. Security depends on the complete technology environment and on how it is designed, maintained and operated.
What does PHP remote code execution mean?
Remote code execution (RCE) is a class of vulnerability that lets an attacker run code on a vulnerable system from another location. The consequences depend on the affected system, its configuration and the privileges the attacker gains.
Where can I find reliable information about the PHP vulnerability?
Read the official PHP security advisory and guidance from recognized cybersecurity authorities, such as the US Cybersecurity and Infrastructure Security Agency (CISA) and the Dutch National Cyber Security Centre (NCSC-NL).
Our commitment to dependable service
Technology is central to a consistent customer experience. Shipixy remains focused on responsible technology management and the continued improvement of our digital services. Learn more about Shipixy.
Thank you for choosing Shipixy. Shipping Made Simpler.
Sources
- PHP.net News Archive 2026, official security release for CVE-2026-109618 and CVE-2026-109619, October 21, 2026
- PHP announcement, "PHP 8.5.12 Released"
- Help Net Security, "PHP2Shell: Critical PHP vulnerabilities patched", October 21, 2026
- CISA, "Critical Vulnerabilities in PHP Require Immediate Patching", October 21, 2026
- CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog", October 26, 2026
- NCSC-NL, php2shell operational information
