Critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619

Question

Hello,

I have been trying to get an official reply. The New York State Department of Financial Services (NYDFS) issued a Cybersecurity Alert today (August 11, 2026), regarding two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could enable unauthenticated remote code execution and unauthorized access to server files and databases

Please answer the following questions :

(1) Please confirm whether PHP is currently implemented in our web environment

(2)whether any systems, data, or web development may have been affected by aforementioned PHP vulnerabilities,

(3) any actions taken to mitigate the vulnerabilities.

Thanks for your help!

Calvin Kwan · Answer

Yes, thank you for your help. I have emailed them last week but no luck so that's why I am posting here hoping someone at JIRA would see it. Thanks for the reply!

Arkadiusz Wroblewski · Answer

Hello @Calvin Kwan

We're a community of users, so we can't provide an official security assessment.

Atlassian has already addressed these vulnerabilities here:

https://community.atlassian.com/forums/discussion/3315285/php2shell-used-in-atlassian-products

For further information or confirmation about your environment, please check Atlassian's security advisories or contact Atlassian Support.

Cheers,

Arek🤠🧙‍♂️