Alloy Software Products Unaffected by PHP2Shell Vulnerabilities
No product-specific action is required for Alloy Navigator or AlloyScan.
At a glance
Alloy Navigator and AlloyScan are unaffected by PHP2Shell. No product-specific action is required for cloud or on-premises deployments.
All internal Alloy servers running PHP have been patched. If your organization uses other PHP-based software, review those systems and apply the relevant security updates.
What happened?
On October 21, 2026, the PHP development team released security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.
The vulnerabilities affect PHP’s internal memory management and error handling. Under certain conditions, an unauthenticated attacker could exploit these flaws to execute code on a vulnerable server. Both vulnerabilities have a CVSS v4.0 score of 9.2 (Critical).
Security fixes are available in PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Organizations running affected versions of PHP should update immediately. Further technical details are available in the PHP Foundation’s announcement.
What does this mean for you?
Neither Alloy Navigator nor AlloyScan uses PHP in its application architecture, so these vulnerabilities do not affect the server-side or web application components of either product. This applies to both cloud-hosted and on-premises deployments.
You do not need to install product-specific patches or change your Alloy configurations to address PHP2Shell.
What has Alloy Software done?
Although our products do not rely on PHP, some systems within our internal infrastructure use this technology. Following the release of the security fixes, we promptly updated all internal servers running PHP to versions containing the fixes. These updates are complete.
We continuously monitor security developments, assess potential risks to our products and infrastructure, and take action when vulnerabilities are identified. We also keep customers informed about security issues relevant to their Alloy environments.
Check your other systems
If your organization uses PHP in other applications, websites, or services, review those systems and apply the appropriate security updates. This includes PHP-based software running alongside Alloy products on the same servers.
If you have questions about your Alloy environment, please contact our support team.
Stay connected
Follow us on LinkedIn for the latest product insights, feature previews, and more exclusive updates.
Considering our ITSM solution?
Talk to our sales team to find out if we’re a match
Latest News
Alloy Software Products Unaffected by PHP2Shell VulnerabilitiesOctober 22, 2026- AlloyScan 26.10 Update: Remote Restarts and AnalyticsOctober 13, 2026
- Introducing Allie, the AI Assistant for IT TeamsOctober 12, 2026
