On October 21, 2026, the PHP project disclosed two critical vulnerabilities in PHP, known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. The vulnerabilities can allow unauthenticated remote code execution on affected systems, making it important for organizations to determine whether they use PHP and apply available updates where needed. news-web.php.net
ShareVault reviewed its environment as soon as the disclosure was made. Our review confirmed that the ShareVault platform does not run on PHP. One supporting component in our environment does use PHP, and it has been updated to a patched release. Our hosting provider has also patched the PHP software used by our public website.
What This Means for ShareVault Customers
ShareVault customer data was not exposed as a result of these vulnerabilities. The ShareVault platform does not use the affected PHP software, and our review found no impact to customer information or data rooms.
Customers do not need to take any action. You can continue using ShareVault as usual. There is no need to change your account settings, update documents, or make changes to your data room because of PHP2Shell.
How ShareVault Responded
Our team reviewed the disclosure and checked the components in our environment that could be relevant. We confirmed that the ShareVault platform does not run on PHP, updated the supporting component that does use PHP to a patched release, and confirmed that our hosting provider had patched our public website.
We are sharing this update so customers have a clear explanation of the issue and ShareVault’s response. If you have questions about PHP2Shell or this notice, contact [email protected].
