Semarchy has reviewed the critical PHP vulnerabilities disclosed in October 2026, together known as “PHP2Shell”.
Semarchy xDM, xDI and the Semarchy Data Platform (SDP) are not affected by either vulnerability. No Semarchy product is affected.
Vulnerabilities reviewed
CVE-2026-109618: memory corruption during out-of-memory handling, which can lead to unauthenticated remote code execution (CVSS v4.0: 9.2). NVD entry · PHP advisory GHSA-w8hw-w9fx-j79w
CVE-2026-109619: a use-after-free flaw involving state kept between requests, which can lead to unauthenticated remote code execution (CVSS v4.0: 9.2). NVD entry · PHP advisory GHSA-6wmf-4rv5-p3rp
Impact on Semarchy products
These vulnerabilities only affect systems that run PHP. Semarchy xDM, xDI and the Semarchy Data Platform are not built on PHP and do not include or use the PHP runtime, PHP interpreters or PHP-based components in any version. This applies to every deployment model: Semarchy-managed cloud, customer self-hosted cloud and on-premises. Because the vulnerable code is not present, these CVEs cannot be exploited through Semarchy software.
Customer action
No action is required for Semarchy products, and no patch or configuration change is needed for your Semarchy deployments. If you run PHP elsewhere in your environment, we recommend upgrading to a fixed PHP release (8.5.12, 8.4.27, 8.3.36 or 8.2.35) as advised by the PHP project.
We continuously monitor newly disclosed vulnerabilities and assess their potential impact on our products. Should this assessment change, we will update this advisory and notify you promptly.
Questions
Please contact Semarchy Support through the Semarchy Support Portal.
Stéphanie FOURRIER
Published: October 23, 2026
Summary
Semarchy has reviewed the critical PHP vulnerabilities disclosed in October 2026, together known as “PHP2Shell”.
Semarchy xDM, xDI and the Semarchy Data Platform (SDP) are not affected by either vulnerability. No Semarchy product is affected.
Vulnerabilities reviewed
Impact on Semarchy products
These vulnerabilities only affect systems that run PHP. Semarchy xDM, xDI and the Semarchy Data Platform are not built on PHP and do not include or use the PHP runtime, PHP interpreters or PHP-based components in any version. This applies to every deployment model: Semarchy-managed cloud, customer self-hosted cloud and on-premises. Because the vulnerable code is not present, these CVEs cannot be exploited through Semarchy software.
Customer action
No action is required for Semarchy products, and no patch or configuration change is needed for your Semarchy deployments. If you run PHP elsewhere in your environment, we recommend upgrading to a fixed PHP release (8.5.12, 8.4.27, 8.3.36 or 8.2.35) as advised by the PHP project.
We continuously monitor newly disclosed vulnerabilities and assess their potential impact on our products. Should this assessment change, we will update this advisory and notify you promptly.
Questions
Please contact Semarchy Support through the Semarchy Support Portal.