Resolved after 56 minutes, on October 21, 2026.
We are continuing to monitor for any further issues.
Update timeline
- monitoring Oct 21, 2026, 08:43 PM UTC
Instructure is aware of CVE-2026-109618 and CVE-2026-109619 (referred to as "PHP2Shell"), affecting PHP. The Canvas application does not use PHP and is not affected. We have completed an initial assessment of our other products. Where affected PHP versions are in use, we are prioritizing remediation and have implemented compensating controls and additional monitoring while that work is completed. We will update as remediation progresses.
- monitoring Oct 21, 2026, 09:32 PM UTC
We are continuing to monitor for any further issues.
Your product runs on more than Instructure
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services