Notion incident

PHP2Shell (CVE-2026-109618, CVE-2026-109619)

Resolved after 3 days 18 hours, on October 23, 2026.

resolved Oct 26, 2026, 06:24 PM UTC

Please visit our Security Advisories page at https://www.notion.com/security/advisories for any future updates.

Started
Oct 23, 2026, 12:14 AM UTC
Resolved
Oct 26, 2026, 06:24 PM UTC
Duration
3d 18h
Detected by Pingoru
Oct 23, 2026, 12:14 AM UTC

Update timeline

  1. identified Oct 23, 2026, 12:14 AM UTC

    We have found no impact to Notion from PHP2Shell. Notion's services do not run PHP. Our review is continuing, and we'll update this notice if anything changes.

  2. monitoring Oct 23, 2026, 12:24 AM UTC

    Status: No impact identified; review ongoing We have found no impact to Notion from PHP2Shell. Notion's services do not run PHP. Our review is continuing, and we'll update this notice if anything changes.

  3. resolved Oct 26, 2026, 06:24 PM UTC

    Please visit our Security Advisories page at https://www.notion.com/security/advisories for any future updates.

  4. resolved Oct 26, 2026, 06:24 PM UTC

    Please visit our Security Advisories page at https://www.notion.com/security/advisories for any future updates.

Your product runs on more than Notion

Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.

Add your stack →