Security Update: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”)
October 22, 2026
Dear Customers,
On October 21, 2026, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated remote code execution in affected versions of PHP.
InGo platform
Our engineering team assessed the InGo production environment, including our deployed workloads and application components. InGo does not use or operate PHP in our production environment, so the InGo platform is not affected by these vulnerabilities. We have found no indication of exploitation or unauthorized access involving customer data.
Subprocessors
We contacted each sub-processor that handles customer data to confirm its exposure. So far no exposure has been identified, we are continuing to monitor this situation actively and will update this page if any new developments arise.
Customer action
No action is required from InGo customers.
Security and transparency are central to how we operate. If you have questions or need a formal written confirmation, please contact us at support@ingo.me.
Sincerely,
The InGo Team