PHP2Shell Security Response

Cognizo does not run on PHP anywhere. None of our production, staging, or internal systems use PHP, and a full review of our software packages found no PHP components anywhere in our stack. Cognizo is not affected by the recently disclosed PHP2Shell vulnerabilities, and no action is required from our customers.

We are publishing this for transparency with our customers.

What happened

The PHP project released emergency patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They allow attackers to run code on servers that use PHP, and they are being actively exploited.

Impact on Cognizo

• No exposure. Cognizo's application, APIs, data pipelines, and internal tools are not built on PHP and do not run a PHP runtime.
• No affected dependencies. We evaluated every package across our codebases and found no PHP components, direct or transitive.
• No customer impact. There was no service interruption, no credential rotation, and no change to how customers use Cognizo.

What we did

1. Inventoried our stack. We confirmed that no service, container image, or server in any environment runs PHP.
2. Audited our packages. We reviewed all direct and transitive dependencies across our repositories for PHP components or bundled PHP runtimes.
3. Checked our scanning results. Our continuous vulnerability scanning, which covers our own stack, flagged no findings related to CVE-2026-109618 or CVE-2026-109619.

How we stay ahead of issues like this

We run continuous vulnerability scanning across our own infrastructure and dependencies. When a new CVE is published, it is checked against our stack automatically, so issues like PHP2Shell are caught as they appear rather than discovered after the fact. Findings are triaged and fixed according to severity.

If you have questions about this advisory or our security practices, contact us at [email protected].