Resolved on October 22, 2026.
On 21 October 2026, two critical vulnerabilities in the PHP programming language were disclosed, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They can allow an attacker to run code on servers that use PHP to handle web requests. The Urbantz platform is built mainly on Node.js and Python, and none of these components use PHP. One small internal service uses PHP, but it runs through a Go-based application server rather than the standard PHP web server setups named in the official advisory. Our assessment is that it is not exposed to the publicly reported attack paths. As a precaution, we are updating the PHP version it runs to the patched release. We have found no indication that any Urbantz system has been affected, and our platform team continues to monitor the situation. We will post an update here if anything changes.
Update timeline
- resolved Oct 22, 2026, 08:29 AM UTC
On 21 October 2026, two critical vulnerabilities in the PHP programming language were disclosed, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They can allow an attacker to run code on servers that use PHP to handle web requests. The Urbantz platform is built mainly on Node.js and Python, and none of these components use PHP. One small internal service uses PHP, but it runs through a Go-based application server rather than the standard PHP web server setups named in the official advisory. Our assessment is that it is not exposed to the publicly reported attack paths. As a precaution, we are updating the PHP version it runs to the patched release. We have found no indication that any Urbantz system has been affected, and our platform team continues to monitor the situation. We will post an update here if anything changes.
Your product runs on more than Urbantz
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services