Selector is not impacted by CVE-2026-109618 or CVE-2026-109619. Both vulnerabilities affect systems that run the PHP scripting language runtime and its associated server configurations.
On October 23, 2026, the Selector team completed a review of our technology stack, infrastructure, and deployed applications. PHP is not present anywhere in our environment. Selector customers do not need to take any action in response to these advisories as they relate to Selector.
About the Vulnerabilities
On October 21, 2026, the PHP project disclosed two critical flaws in the PHP runtime and released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Both can allow unauthenticated remote code execution on servers that run PHP to handle web requests. Security researchers have nicknamed the pair “PHP2Shell.”
| CVE | Issue | Severity | Official Records |
| CVE-2026-109618 | Remote code execution through improper out-of-memory handling during request cleanup | Critical (CVSS v4.0 9.2) | CVE record |
| CVE-2026-109619 | Remote code execution through stale internal state left over from an earlier request | Critical (CVSS v4.0 9.2) | CVE record |
The PHP project’s full announcement is available on php.net.
What We Reviewed
Our assessment covered three areas:
- Technology stack: PHP is not used in any of our production, staging, development, or internal environments.
- Software dependencies: None of our active dependencies, microservices, or third-party web frameworks rely on PHP runtimes or PHP-based interpreters.
- Infrastructure: No web server or application environment across our infrastructure hosts a PHP execution engine or handler module, such as PHP-FPM or mod_php.
Impact Summary
| Vulnerability | Affected Technology | Selector Usage | Impact |
| CVE-2026-109618 | PHP runtime and ecosystem | Not installed, not used | Not impacted |
| CVE-2026-109619 | PHP runtime and ecosystem | Not installed, not used | Not impacted |
Because PHP is absent from our stack, Selector systems require no patches, mitigation steps, or configuration changes for either vulnerability.
Ongoing Security Monitoring
Selector continuously monitors its asset inventory and software bill of materials (SBOM) to track exposure to newly disclosed vulnerabilities. We review each new advisory against that inventory and publish updates when they affect our customers.
Customers who want more detail, including our SBOM scanning results, can contact us at security@selector.ai.
