Finite State Statement on PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Finite State is not affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619). Our platform is not built on PHP, and no action is needed by customers.
Sharon Hagi
Chief Security Officer
Finite State's security and engineering teams found no PHP in our production environments, product source code, or website. No action is needed by customers in relation to their use of Finite State tools, platforms, and services.
Last updated: October 22, 2026, 3:00 p.m. ET
What Happened
On October 21, 2026, the PHP project released fixes for two critical vulnerabilities in the PHP programming language, known together as PHP2Shell. They allow an attacker to run code on a web server that uses an unpatched version of PHP, and attempts to exploit them have been reported. Because PHP is used widely, organizations around the world are checking their exposure, and several of our customers have asked whether Finite State is affected.
Finite State is Not Affected
Our security and engineering teams reviewed our exposure as soon as the vulnerabilities were disclosed. The Finite State platform is not built on PHP. Our review found no PHP in our production environments, in our product source code, or in any part of our website. The Finite State platform, the services we host for customers, and the data our customers have entrusted to us are not affected by PHP2Shell. No action is needed by customers in relation to their use of Finite State tools, platforms, and services.
For Customers Who Use PHP in Their Own Products
Many connected products include PHP in their firmware, often an older version that will not receive a fix from the PHP project. The Finite State platform identifies PHP components in firmware and software images. If you want help confirming whether products in your portfolio are affected, reach out to your Finite State sales representative or contact us.
What We Are Doing
We continue to monitor and follow guidance from the PHP project and the security research community, and we will update this statement if new information changes our assessment.
Questions
Customers with questions can reach out to their Finite State sales representative or contact us.
Sharon Hagi
Chief Security Officer
Sharon Hagi is an industry-recognized cybersecurity executive and Chief
Security Officer at Finite State, where he leads the company’s security and
services programs, helping organizations secure connected devices and
embedded software at scale. His work focuses on advancing practical,
production-ready product security for IoT, microcontrollers, and AI-enabled
systems in increasingly regulated ecosystems.
